Website Filtering Dillema

[buppd96]

Good morning, I've got a situation where some students are going to an inappropriate gaming site that also bypasses the content filtering I have in place and allows access to some adult content, this is one of the websites: https://friv2025.com, the issue I'm having is I can block this particular URL, but all they need to do is change the year in the URL and the site is again accessable, example: friv2024.com, friv2023.com, friv2018.com, etc.  I've tried different wild cards (they seem ineffective since the year is in the parent domain and not a sub-domain), I've tried blocking by site IP's, tried looking up name servers for these sites and blocked those, I did find one of these sites, I think it was friv2018.com redirected to www.weslack.com, however adding that weslack.com URL to my block list prevented direct access to that site, but did not stop any redirects to it via one of the "friv.com" URL's. 

I did find that cloudflare.com is what these sites are using, however I cannot block cloudflare since that would block many URL's that my programs use are dependant on cloudflare.   I have a PA440 running PAN-OS 11.1.4-h7, Global Protect 6.3.3, Dynamic Updates 8990-9489, and DLP 5.0.5.   

Does anyone have a suggestion on how I could block access to all of the "friv.com" sites even if the students change the year in the URL without having to resort to doing any crazy and extraordinary configations to the firewall and/or client machines?

Thanks. 

[BPry]

@buppd96,

The examples that you have listed are all categorized as games, can you just block the category for students? Most schools that I've worked with will end up blocking games, proxy-avoidance-and-anonymizers, unknown, and newly-registered-domain to deal with this sort of thing. Then you can make exceptions for any particular domains that you actually want to allow.

I'd also caution that you need policies to actually drive this and technology is just there as assistance and identification. You aren't going to be able to fully prevent students from bypassing filtering, they simply have too much time to try and find ways around your filtering and are too incentivized to do so.