Skip to main content
PPPhishPondPhishing Tradecraft Intelligence

Attack · Detection · Validation

CampaignTradecraftInfrastructureDetectionResearchRadarNewsroomAboutSubscribe
CampaignTradecraftInfrastructureDetectionResearchRadarNewsroomAboutSubscribe

Research Desk

PhishPond

Phishing tradecraft research desk covering campaign analysis, adversary infrastructure, detection engineering, and validation workflows.

High signal for security teams who need tradecraft, not recycled filler.

Navigate

  • Home
  • Newsroom
  • Research
  • Subscribe

Signals

  • editorial@phishpond.dev
  • Research Mission & Ethics
  • Intel Brief
  • RSS Feed
  • Submit Research Tip
© 2026 PhishPond. Authorized security research use only.

GitHub RadarBlue team tool

hagezi/dns-blocklists

DNS-Blocklists: For a better internet - keep the internet clean! Primary language: Text. 23,674 stars.

Text23,674 stars711 forkspushed Jun 12, 2026GPL-3.0

Project links:Open GitHub projectBack to radar

README Preview

Fetched from GitHub

Image: GitHub last commitImage: GitHub issuesImage: GitHub closed issuesImage: GitHub repo size![shields.io Stars](https://github.com/hagezi/dns-blocklists/stargazers)

:zap: DNS Blocklists - For a better internet!

Made with :heartbeat: for a safer and cleaner internet! It always seems impossible until it’s done.

Privacy is not a crime, protect yourself. Privacy matters. Privacy is what allows us to determine who we are and who we want to be :bangbang:

If you like the project and you can benefit from it, leave a :star: (top right) and become a stargazer! Thanks for your support!

---

:bookmark_tabs: Table of Contents
  1. Overview
  2. Multi light - Hand brush: Light protection
  3. Multi normal - Broom: All-round protection
  4. Multi pro - Big broom: Extended protection (Recommended) : Full - Mini
  5. Multi pro++ - Sweeper: Maximum protection (more aggressive) : Full - Mini
  6. Multi ultimate - Ultimate Sweeper: Aggressive protection : Full - Mini
  7. Fake - Protects against internet scams, traps & fakes!
  8. Pop-Up Ads - Protects against annoying and malicious pop-up ads!
  9. Threat Intelligence Feeds - Increases security significantly! (Recommended) : Full - Medium - Mini - IPs
  10. Newly Registered Domains - NRD/DGA - Favoured by threat actors to launch malicious campaigns!
  11. DoH/VPN/TOR/Proxy Bypass - Prevent methods to bypass your DNS! : Full - DoH only - DoH IPs
  12. Safesearch not supported - Prevent the use of search engines that do not support Safesearch!
  13. Dynamic DNS - Protects against the malicious use of dynamic DNS services!
  14. Badware Hoster - Protects against the malicious use of host services!
  15. URL Shortener - Blocks link/URL shortener!
  16. Most Abused TLDs - Protects against known malicious Top Level Domains!
  17. DNS Rebind Protection - Prevents attackers from resolving domains to local IPs!
  18. Anti Piracy - Protects against piracy!
  19. Gambling - Protects against gambling content! : Full - Medium - Mini
  20. Social Networks - Blocks access to social networks!
  21. NSFW - Protects against adult content!
  22. Native Tracker - Broadband tracker of devices, services and operating systems
  23. Supporter - Leave a star (top right)!
  24. Recommendation - Which version of the lists should I use?
  25. Online DNS Services : HaGeZi DNS - DNS Bunker
  26. About : Repository - Referral Domains - Support
  27. FAQ - Frequently Asked Questions
  28. Discussions
  29. Sources
  30. Disclaimer
  31. Contact
:books: Multi - Cleans the Internet and protects your privacy! <a name="overview"></a>

An all-in-one DNS blocklist in various versions (light, normal, pro, pro++ and ultimate). It can be used as a standalone blocklist. For every region. Blocks ads, affiliate, tracking, metrics, telemetry, fake, phishing, malware, scam, cryptojacking and other "crap". Based on various blocklists. No, they are not just block lists cobbled together from different sources. They have been optimized and extended to efficiently "clean the Internet" in all areas.

See also: Which sources are used for the lists and how are the lists compiled on the basis of these sources?

Blocklist version and size overview:

| Version | Entries | Pro++ | Pro | Nor<br>mal | Light | Fake | TIF | Nat<br>ive | PopUp<br>Ads | Bug<br>Tracker | |:--------|---:|:------:|:-----:|:----:|:----:|:---:|:------:|:----------:|:----:|:----:| | :green_book:Light | 95213<br>44603 | | | | :green_circle: | | | :yellow_square: | :yellow_square: | | | :blue_book:Normal | 334374<br>144271 | | | :green_circle: | :green_circle: | | :yellow_square: | :yellow_square: | :yellow_square: | | | :ledger:Pro | 458234<br>209496 | | :green_circle: | :green_circle: | :green_circle: | | :yellow_square: | :yellow_square: | :green_circle: | :green_circle: | | :orange_book:Pro++ | 501383<br>227506 | :green_circle: | :green_circle: | :green_circle: | :green_circle: | |:yellow_square: | :yellow_square: | :green_circle: | :green_circle: | | :closed_book:Ultimate | 541008<br>243951 | :green_circle: | :green_circle: | :green_circle: | :green_circle: | | :yellow_square: | :green_circle: | :green_circle: | :green_circle: |

:green_circle: contains the list named in the column caption :yellow_square: partially contains the list named in the column caption

Blocking level:

| Version | Blocking<br>level | Blocking<br>type | |:--------|:---------------|:--------------| | :green_book:Light | :green_book::green_book: | Relaxed | | :blue_book:Normal | :blue_book::blue_book::blue_book: | Relaxed/Balanced | | :ledger:Pro | :ledger::ledger::ledger::ledger: | Balanced | | :orange_book:Pro++ | :orange_book::orange_book::orange_book::orange_book::orange_book::orange_book: | Balanced/Aggressive | | :closed_book:Ultimate | :closed_book::closed_book::closed_book::closed_book::closed_book::closed_book::closed_book: | Aggressive |

[!TIP]
:information_desk_person: Which version of the lists should I use?

---

:green_book: Multi LIGHT - Basic protection <a name="light"></a>

Hand brush - Cleans the Internet and protects your privacy! Blocks Ads, Tracking, Metrics and some Badware. A size-optimized version of the Multi NORMAL.

[!NOTE]
Blocking type: Relaxed
This list version should not lead to any restrictions. It is particularly suitable for environments in which there is no admin nearby who can unblock something and if you have to pay attention to the size of the list, because the AdBlocker does not support large lists.
[!IMPORTANT]
Does not block error trackers such as Bugsnag, Crashlytics, Firebase, Instabug, Sentry, ... and other app-specific crash trackers. These are only blocked from the Pro version onwards.

Entries: 95213 domains/hosts - 10580 compressed hosts - 44603 compressed domains

| Format | Links | Should be used for | |:-------|:-----|:----------------| | Domains<br>Subdomains | Link M1 M2 | Blocky (older than v0.23), Diversion (older than v5), PersonalBlocklist, pfBlockerNG | | Hosts | Link M1 M2 | AdAway, uMatrix, OpenSnitch, DNS66, NetGuard | | Hosts<br>Compressed | Link M1 M2 | Hostfile, Linux | | Adblock | Link M1 M2 | Pi-hole, AdGuard, AdGuard Home, eBlocker, uBlock Origin, Brave (only in aggressive mode), AdNauseam, Little Snitch Mini | | DNSMasq | Link M1 M2 | DNSMasq (v2.86 or newer), Diversion (v5 or newer) | | Wildcard<br>Asterisk | Link M1 M2 | Blocky (v0.23 or newer), Nebulo, NetDuma, OPNsense, YogaDNS | | Wildcard<br>Domains | Link M1 | DNSCloak, DNSCrypt, TechnitiumDNS, adblock-lean, PersonalDNSfilter, InviZible Pro | | RPZ | | Response Policy Zone, Bind, Knot, PowerDNS, Unbound | | PAC | | Proxy Auto Configuration |

:blue_book: Multi NORMAL - All-round protection <a name="normal"></a>

Broom - Cleans the Internet and protects your privacy! Blocks Ads, Affiliate, Tracking, Metrics, Telemetry, Phishing, Malware, Scam, Fake, Cryptojacking and other "Crap".

[!NOTE]
Blocking type: Relaxed/Balanced
This list version should not lead to any restrictions for the most part. It is particularly suitable for environments in which there is no admin nearby who can unblock something.
[!IMPORTANT]
Does not block error trackers such as Bugsnag, Crashlytics, Firebase, Instabug, Sentry, ... and other app-specific crash trackers. These are only blocked from the Pro version onwards.

Entries: 334374 domains/hosts - 37153 compressed hosts - 144271 compressed domains

| Format | Links | Should be used for | |:-------|:-----|:----------------| | Domains<br>Subdomains | Link M1 M2 | Blocky (older than v0.23), Diversion (older than v5), PersonalBlocklist, pfBlockerNG | | Hosts | [Link](https://cdn.jsdelivr.net/gh/hagezi/dns-bloc

M2
Link
M1
M2
Link
M1
M2