Are they? Black/whitelist feels way more natural to me. You can also say things like "blacklisted this ip" instead of "adding to the deny list" or something.
that these are stored in a particular data structure isn't the important part IMO