This site publishes 14 curated threat-intelligence blocklists alongside a single consolidated master zone that merges and deduplicates every list into one ready-to-deploy artifact.
Who it's for. DNS resolver operators running Unbound, BIND, Knot, or any RPZ-capable server can drop in master.rpz.zone (download master.rpz.zone.gz and gunzip it) or any individual list and block malicious lookups at the resolver layer. The AdBlock-format variants are intended primarily for AdGuard Home DNS server deployments; performance in browser AdBlock extensions (uBlock Origin, AdBlock Plus, etc.) is not tested and not a design target.
What's included. Each upstream source is published in up to four variants: an RPZ Dedupe file (the source's own entries with duplicates against other lists removed), an RPZ Full file (every entry the source provides, before cross-list deduplication), and matching AdBlock Dedupe and AdBlock Full files in adblock-format syntax. The master.rpz.zone file consolidates all dedupe-RPZ lists into one zone with a fresh SOA record and a rich comment-block header documenting per-source provenance.
| File | Entries | IPs | Updated (UTC) | Download |
|---|---|---|---|---|
| master.rpz.zone.gz | 4,331,761 | 36,488 (0.8%) | 2026-11-01 19:10 | 22.65 MBGZIP |
| List | RPZ Entries | IPs | Updated (UTC) | RPZ Dedupe | RPZ Full | AdBlock Dedupe | AdBlock Full |
|---|---|---|---|---|---|---|---|
| tif-domain | 3,730,838 | 0 | 2026-11-01 17:02 | 18.36 MBGZIP | 19.45 MBGZIP | 37.46 MBADB | 39.34 MBADB |
| └─[RPZ]dedupe3,730,838→full3,909,011−5%[ADB]dedupe1,896,547→full1,989,817−5% | |||||||
| phishing_army_extended | 217,061 | 0 | 2026-11-01 17:02 | 1.53 MBGZIP | 1.76 MBGZIP | 3.10 MBADB | 3.57 MBADB |
| └─[RPZ]dedupe217,061→full251,853−14%[ADB]dedupe131,254→full151,991−14% | |||||||
| cyberhost | 144,097 | 0 | 2026-11-01 19:02 | 1014.41 KBGZIP | 1014.40 KBGZIP | 2.12 MBADB | 2.12 MBADB |
| └─[RPZ]dedupe144,097→full144,097−0%[ADB]dedupe97,943→full97,943−0% | |||||||
| KADhosts | 58,905 | 0 | 2026-11-01 15:02 | 430.70 KBGZIP | 431.10 KBGZIP | 1.07 MBADB | 1.07 MBADB |
| └─[RPZ]dedupe58,905→full58,960−0%[ADB]dedupe43,960→full43,992−0% | |||||||
| threatfox | 45,008 | 0 | 2026-11-01 19:02 | 444.57 KBGZIP | 468.07 KBGZIP | 766.33 KBADB | 807.89 KBADB |
| └─[RPZ]dedupe45,008→full48,018−6%[ADB]dedupe31,211→full33,112−6% | |||||||
| xRuffKez-TIF | 43,722 | 0 | 2026-11-01 19:02 | 451.88 KBGZIP | 2.83 MBGZIP | 1.37 MBADB | 5.35 MBADB |
| └─[RPZ]dedupe43,722→full404,651−89%[ADB]dedupe40,695→full231,898−82% | |||||||
| ShadowWhisperer | 40,856 | 0 | 2026-10-31 19:02 | 322.52 KBGZIP | 687.48 KBGZIP | 427.12 KBADB | 995.04 KBADB |
| └─[RPZ]dedupe40,856→full91,813−56%[ADB]dedupe20,550→full46,712−56% | |||||||
| tif-ip | 35,450 | 35,450 | 2026-11-01 12:02 | 167.16 KBGZIP | 169.08 KBGZIP | 599.49 KBADB | 606.97 KBADB |
| └─[RPZ]dedupe35,450→full35,906−1%[ADB]dedupe35,450→full35,906−1% | |||||||
| malicious | 5,714 | 0 | 2026-10-30 07:02 | 43.43 KBGZIP | 48.48 KBGZIP | 65.80 KBADB | 74.26 KBADB |
| └─[RPZ]dedupe5,714→full6,470−12%[ADB]dedupe3,155→full3,566−12% | |||||||
| phishing | 5,009 | 0 | 2026-11-01 13:02 | 51.17 KBGZIP | 279.64 KBGZIP | 123.64 KBADB | 714.36 KBADB |
| └─[RPZ]dedupe5,009→full28,288−82%[ADB]dedupe4,109→full23,491−83% | |||||||
| napkin | 2,864 | 0 | 2026-11-01 06:02 | 16.10 KBGZIP | 16.54 KBGZIP | 48.90 KBADB | 50.14 KBADB |
| └─[RPZ]dedupe2,864→full2,968−4%[ADB]dedupe2,124→full2,193−3% | |||||||
| stalkerware | 1,199 | 0 | 2026-10-20 20:02 | 7.28 KBGZIP | 7.29 KBGZIP | 25.66 KBADB | 25.69 KBADB |
| └─[RPZ]dedupe1,199→full1,204−0%[ADB]dedupe990→full993−0% | |||||||
| binarydefense | 731 | 731 | 2026-11-01 00:02 | 4.79 KBGZIP | 4.79 KBGZIP | 14.10 KBADB | 14.07 KBADB |
| └─[RPZ]dedupe731→full731−0%[ADB]dedupe731→full731−0% | |||||||
| emergingthreats-compromised | 307 | 307 | 2026-10-30 21:02 | 2.65 KBGZIP | 4.00 KBGZIP | 7.16 KBADB | 11.08 KBADB |
| └─[RPZ]dedupe307→full542−43%[ADB]dedupe307→full542−43% | |||||||
| List | Source |
|---|---|
| KADhosts | raw.githubusercontent.com·FiltersHeroes/KADhosts |
| ShadowWhisperer | raw.githubusercontent.com·ShadowWhisperer/BlockLists |
| binarydefense | www.binarydefense.com·Binary Defense |
| cyberhost | lists.cyberhost.uk·CyberHost |
| emergingthreats-compromised | rules.emergingthreats.net·Proofpoint ET Intelligence |
| malicious | hosts.tweedge.net·tweedge/emerging-threats-pihole |
| napkin | raw.githubusercontent.com·durablenapkin/scamblocklist |
| phishing | malware-filter.gitlab.io·malware-filter/malware-filter |
| phishing_army_extended | phishing.army·drego85/PhishingArmyCore |
| stalkerware | raw.githubusercontent.com·AssoEchap/stalkerware-indicators |
| threatfox | threatfox.abuse.ch·abuse.ch |
| tif-domain | hagezi-mirror.dnsbunker.org·hagezi/dns-blocklists |
| tif-ip | hagezi-mirror.dnsbunker.org·hagezi/dns-blocklists |
| xRuffKez-TIF | raw.githubusercontent.com·DNSBunker/CTI |
To contact the maintainer of this project regarding any concerns, please complete the form at mocosec.com/report-concern/
This site is an aggregator. The data files published here are derivative compilations of upstream threat-intelligence feeds — see the Sources & attribution table above for each source and its maintainer.
No ownership is claimed over the underlying data. Each upstream feed retains its own license and terms of use; downstream consumers are responsible for reviewing and complying with those upstream terms before redistributing or building on top of these lists. Some upstream sources restrict commercial use, require attribution, or prohibit redistribution entirely — the URLs in the Sources table are the authoritative reference.
The compilation work itself (deduplication, format conversion, file layout, page generation) is offered as-is with no warranty of any kind. Use at your own risk.