Allowlisting, yes. Keep in mind that even fairly unsophisticated malware has been observed using channels like pastebin and Twitter for exfil/c2. Blocklisting,

Allowlisting, yes. Keep in mind that even fairly unsophisticated malware has been observed using channels like pastebin and Twitter for exfil/c2. Blocklisting, that's a cat and mouse game. Go look at how many different URLs and IPs are utilized for commercial telemetry in the likes of Adobe and Microsoft software if you aren't familiar.