Techniques for evaluating a questionable network communication are disclosed. In some implementations, a network of computing systems or devices is provided. Each system includes an evaluation module that determines whether an outbound or inbound network communication is allowable based on one or more factors or properties of the communication, including one or more of an IP address, a listening port, a geographic location, time of day, or the like. The systems in the network may be configured to only communicate with other devices that are identified in a white list of trusted computing systems.