Skip to main content
PPPhishPondPhishing Tradecraft Intelligence

Attack · Detection · Validation

CampaignTradecraftInfrastructureDetectionResearchRadarNewsroomAboutSubscribe
CampaignTradecraftInfrastructureDetectionResearchRadarNewsroomAboutSubscribe

Research Desk

PhishPond

Phishing tradecraft research desk covering campaign analysis, adversary infrastructure, detection engineering, and validation workflows.

High signal for security teams who need tradecraft, not recycled filler.

Navigate

  • Home
  • Newsroom
  • Research
  • Subscribe

Signals

  • editorial@phishpond.dev
  • Research Mission & Ethics
  • Intel Brief
  • RSS Feed
  • Submit Research Tip
© 2026 PhishPond. Authorized security research use only.

GitHub RadarBlue team tool

hagezi/dns-blocklists

DNS-Blocklists: For a better internet - keep the internet clean! Primary language: Text. 26,191 stars.

Text26,191 stars798 forkspushed Sep 10, 2026GPL-3.0

Project links:Open GitHub projectBack to radar

README Preview

Fetched from GitHub

![License: GPL-3.0](https://www.gnu.org/licenses/gpl-3.0.html)Image: GitHub last commitImage: GitHub issuesImage: GitHub closed issuesImage: GitHub repo size![shields.io Stars](https://github.com/hagezi/dns-blocklists/stargazers)

:zap: DNS Blocklists, let's make the internet a nicer place!

Built with :heartbeat: for a safer, cleaner internet. It always looks impossible until someone just goes ahead and does it.

What this is: a set of DNS blocklists that block ads, trackers, telemetry, phishing, malware, scams, and other unwanted domains network-wide. They work for any region and with every common DNS server, ad blocker, and content blocker.

Like this project? If it's helped you out, drop a :star: (top right) and join the stargazers club! Every star genuinely helps.

<picture> <source media="(prefers-color-scheme: dark)" srcset="https://cdn.jsdelivr.net/gh/hagezi/files@latest/assets/images/dark/hagezi-dns-blocklists.svg"> <source media="(prefers-color-scheme: light)" srcset="https://cdn.jsdelivr.net/gh/hagezi/files@latest/assets/images/light/hagezi-dns-blocklists.svg"> <img src="https://cdn.jsdelivr.net/gh/hagezi/files@latest/assets/images/dark/hagezi-dns-blocklists.svg"> </picture>

New here? Start with Multi PRO plus the Threat Intelligence Feeds list, pick the format that matches your tool, and follow the quick setup guide. Unsure which version fits you? See which list version should I use.

[!NOTE]
About the cleaning tools below. The five Multi versions are named after cleaning tools, and you'll see that wording throughout this page: Light is the hand brush, Normal the broom, Pro the big broom, Pro++ the sweeper, and Ultimate the ultimate sweeper. The bigger the tool, the more thoroughly it cleans, and the more likely it is to sweep up something you wanted to keep.

---

:bookmark_tabs: Table of Contents <a name="toc"></a>
  1. Overview: Which format do I need?
  2. Multi LIGHT, hand brush: basic protection
  3. Multi NORMAL, broom: all-round protection
  4. Multi PRO, big broom: extended protection (recommended): Full - Mini
  5. Multi PRO++, sweeper: advanced protection (more aggressive): Full - Mini
  6. Multi ULTIMATE, ultimate sweeper: maximum protection (most aggressive): Full - Mini
  7. Fake, block scams, traps, and fake sites!
  8. Pop-Up Ads, stop annoying and malicious pop-ups!
  9. Threat Intelligence Feeds, a serious security boost (recommended): Full - Medium - Mini - IPs
  10. Newly Registered Domains (NRD/DGA), a favorite tool of threat actors for launching attacks!
  11. Dynamic DNS (DynDNS), guard against dynamic DNS abuse!
  12. Badware Hoster, guard against malicious hosting services!

---

:books: Multi, cleans up the internet and protects your privacy! <a name="overview"></a>

This is an all-in-one DNS blocklist that comes in several versions (light, normal, pro, pro++, and ultimate). You can run it standalone, and it works for any region. It blocks ads, trackers, metrics, telemetry, fake sites, phishing, malware, scams, cryptojacking, and other junk. It's built on various source blocklists, but that doesn't mean it's just a pile of lists glued together. Everything here has been optimized and extended so it actually cleans up the internet across the board.

Curious about the sources? Check out: Which sources are used for the lists and how are they compiled?

Blocklist versions at a glance: <a name="inclusion-matrix"></a>

<picture> <source media="(prefers-color-scheme: dark)" srcset="https://cdn.jsdelivr.net/gh/hagezi/files@latest/assets/images/dark/inclusion-matrix.svg"> <source media="(prefers-color-scheme: light)" srcset="https://cdn.jsdelivr.net/gh/hagezi/files@latest/assets/images/light/inclusion-matrix.svg"> <img src="https://cdn.jsdelivr.net/gh/hagezi/files@latest/assets/images/dark/inclusion-matrix.svg"> </picture>

For a full inclusion matrix that also covers the standalone lists, see the Cheat Sheet.

Main lists at a glance: <a name="blocking-intensity"></a>

| List | Blocking type | Risk of breakage | Entries | Size-optimized<br>version | |:--------|:--------------|:-----------------|--------:|-----------------------:| | :green_book:Light | Relaxed | Minimal | 35397 | - | | :blue_book:Normal | Relaxed/Balanced | Low | 180051 | Light: 35397 | | :ledger:Pro | Balanced | Low to moderate | 222285 | Mini: 50167 | | :orange_book:Pro++ | Balanced/Aggressive | Moderate | 246398 | Mini: 60381 | | :closed_book:Ultimate | Aggressive | High | 272142 | Mini: 74413 | | :closed_lock_with_key:TIF | Threats only | Low | 2405375 | Medium: 661382<br>Mini: 176987 |

The first five build on each other, so pick exactly one of them. TIF works differently: it's an add-on covering malware, phishing, and other live threats, and it's worth running alongside any tier. The size-optimized versions are alternatives to their full list, never something you add on top. Entry counts change with every build.

[!TIP]
:information_desk_person: Not sure which version fits you? Check this out.
Which format do I need? <a name="formatguide"></a>

Most lists below are published in the same five standard formats. Pick the row that matches your tool. Within these five, the blocked domains are the same, only the way they're written down changes.

| Format | Use it with | |:-------|:------------| | Adblock | Pi-hole, AdGuard, AdGuard Home, eBlocker, uBlock Origin, Brave (aggressive mode only), AdBlock-Fast, AdNauseam, Little Snitch Mini (smaller lists only) | | DNSMasq | DNSMasq (v2.86 or newer), Diversion (v5 or newer) | | Wildcard Asterisk | Blocky (v0.23 or newer), Nebulo, NetDuma, OPNsense, YogaDNS | | Wildcard Domains | DNSCloak, DNSCrypt, FRITZ!Box (FRITZ!OS v8.40 or newer), TechnitiumDNS, adblock-lean, PersonalDNSfilter, InviZible Pro | | RPZ | Bind, Knot, PowerDNS, Unbound, and other software supporting Response Policy Zones |

A handful of lists don't follow this pattern, because their content or their exclusion rules can't be expressed the same way in every format. Those are Most Abused TLDs (its own set of format variants), DNS Rebind Protection (AdGuard only), NRD/DGA (Adblock and plain domains only), and the IP lists for TIF and DoH. Each of those sections spells out what's available.

[!NOTE]
The legacy Subdomains and Hosts formats live in a separate repository. For the complete format-to-tool breakdown, see the FAQ.

---

:green_book: Multi LIGHT, basic protection <a name="light"></a>

Hand brush edition. Cleans up the internet and protects your privacy without going overboard. Blocks ads, trackers, metrics, telemetry, and some badware. Basically a size-optimized version of Multi NORMAL, built only from domains that appear on Top 1M/10M lists (Umbrella, Cloudflare, Tranco, Chrome, BuiltWith, Majestic, DomCop).

[!NOTE]
This version shouldn't cause any real restrictions. Great if your ad blocker chokes on big lists, or anywhere even Normal's low risk is too much.
[!IMPORTANT]
Doesn't block error trackers like Bugsnag, Crashlytics, Firebase, Instabug, Sentry, and similar app crash reporters. Those only get blocked starting with the Pro version.

| Entries | Adblock | DNSMasq | Wildcard<br>Asterisk | Wildcard<br>Domains | RPZ | |:---:|:---:|:---:|:---:|:---:|:---:| | 35397 | Link | Link | Link | Link | Link |

---

:blue_book: Multi NORMAL, all-round protection <a name="normal"></a>

Broom edition. Cleans up the internet and protects your privacy. Blocks ads, trackers, metrics, telemetry, phishing, malware, scams, fakes, cryptojacking, and other junk.

[!NOTE]
This one mostly won't cause restrictions either. Good pick if you don't have an admin handy to unblock anything.
[!IMPORTANT]
Doesn't block error trackers like Bugsnag, Crashlytics, Firebase, Instabug, Sentry, and similar app crash reporters. Those only get blocked starting with the Pro version.

| Entries | Adblock | DNSMasq | Wildcard<br>Asterisk | Wildcard<br>Domains | RPZ | |:---:|:---:|:---:|:---:|:---:|:---:| | 180051 | Link | Link | Link | Link | Link |

---

:ledger: Multi PRO, extended protection (recommended) <a name="pro"></a>

Big broom edition. Cleans up the internet and protects your priva

  • Most Abused TLDs, block known shady top-level domains!
  • DNS Rebind Protection, stop attackers from pointing domains at your local network!
  • DoH/VPN/TOR/Proxy Bypass, stop people from sneaking around your DNS: Full - DoH only - DoH IPs
  • Safesearch not supported, block search engines that skip Safesearch!
  • URL Shortener, block link shorteners!
  • Anti Piracy, block piracy sites!
  • Gambling, block gambling content: Full - Medium - Mini
  • Social Networks, block access to social networks!
  • NSFW, block adult content!
  • Native Tracker, block built-in trackers from devices, apps, and OSes!
  • Blocklist Lookup, check any domain or IP against every list!
  • Blocklists Cheat Sheet, quick reference table for every list at a glance
  • Recommendation: Which list version should I actually use?
  • Online DNS Services: AdGuard DNS - ControlD - HaGeZi DNS - DNS Bunker - Public RDNS - RobinGroppe.de - RethinkDNS - DNSwarden - OpenBLD.net
  • About: Repository - Referral Domains - Support
  • FAQ, frequently asked questions, including the quick setup guide and the glossary
  • Discussions
  • Update Interval/Official Mirrors
  • Sources
  • Disclaimer
  • Contact