@thedarktangent it sounds like you’re describing the job of an outbound web proxy, which works based on domains.

And before “well I shall simply bypass the proxy” if this is well-architected either all traffic gets forced through the proxy, or the firewall simply does not accept connections from not-proxy, causing applications that are not proxy-aware (not uncommon for malware) to simply splat against firewall egress rules.

Many of these do most of the filtering based on category (eg “banking” or “malware”. “Unknown” is really powerful for catching new stuff) but should allow per-domain (sometimes per-full-URL) blocking in addition.