Blocklists

Ready-to-import plain-text blocklists for Pi-hole, AdGuard, dnsmasq, RPZ resolvers, firewalls and SIEMs


Blocklists

Plain-text blocklists for Pi-hole, AdGuard, dnsmasq, RPZ, firewalls and SIEMs

Related Threat Intelligence feeds: malicious domains · URLs · malicious IP list · CSV/JSON feeds · All IOC types

The blocklist formats

Ready-to-consume exports of the last 30 days, one file per consumer format. Rebuilt every 15 minutes, but a file only changes when its entries change. Every file is CC0 with no API key or sign-up - these are the same community-reported IOCs as the rest of TweetFeed, with no additional quality gate.

Domain list Pi-hole

Pi-hole, and anything that takes one bare domain per line.

/v1/blocklist/domains.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/domains.txt

hosts file any /etc/hosts reader

/etc/hosts, Windows hosts file, some routers.

/v1/blocklist/hosts.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/hosts.txt

AdGuard rules AdGuard

AdGuard Home and uBlock-style filter lists. Valid AdGuard/uBlock filter list with a ! metadata header (Title/Homepage/License/Expires), not the generic # header the other files use.

/v1/blocklist/adguard.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/adguard.txt

IP list firewall

Firewalls and edge ACLs.

/v1/blocklist/ips.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/ips.txt

DNS RPZ zone RPZ resolver

BIND, Unbound, PowerDNS Recursor.

/v1/blocklist/rpz.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/rpz.txt

dnsmasq config dnsmasq

dnsmasq, including OpenWrt and pfSense.

/v1/blocklist/dnsmasq.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/dnsmasq.txt

Full URLs SIEM

Proxies, IDS, SIEM/SOAR enrichment - matches on path, not just host.

/v1/blocklist/urls.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/urls.txt

The DNS/host formats block at that level. urls.txt is one full URL per line instead, so it also covers url-type IOCs on shared or otherwise legitimate infrastructure that DNS-level blocking cannot safely reach.

IDS and SIEM

Formats for intrusion detection and log correlation tooling: a tab-separated Zeek Intelligence Framework file (meta.source always tweetfeed.live) and two Wazuh CDB lists. Same rolling 30-day window, same CC0 license. None of the three carries a header comment - Zeek parses every non-#fields line as data, and a Wazuh CDB would compile a # as a literal key - so check freshness with /v1/manifest or the response's Last-Modified header instead.

Zeek intel file Zeek

Zeek's Intelligence Framework, loaded with redef Intel::read_files.

/v1/blocklist/zeek-intel.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/zeek-intel.txt

Wazuh domains CDB Wazuh

Wazuh CDB list for a rule with lookup="match_key" on a domain field.

/v1/blocklist/wazuh-domains.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/wazuh-domains.txt

Wazuh IPs CDB Wazuh

Wazuh CDB list for a rule with lookup="address_match_key" on srcip/dstip.

/v1/blocklist/wazuh-ips.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/wazuh-ips.txt

Corroborated subsets

Subset of domains.txt / ips.txt / urls.txt: entries also listed by at least one of URLhaus, ThreatFox, MalwareBazaar, USOM or IPsum as of the last 6-hourly cross-check. If your change control won't deploy a single-reporter community list, start here - the base lists above remain the full feed. Set membership only, not a quality score and not a verdict.

Domain list (corroborated) Corroborated

domains.txt entries also listed by URLhaus, ThreatFox, MalwareBazaar, USOM or IPsum.

/v1/blocklist/domains-corroborated.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/domains-corroborated.txt

IP list (corroborated) Corroborated

ips.txt entries also listed by URLhaus, ThreatFox, MalwareBazaar, USOM or IPsum.

/v1/blocklist/ips-corroborated.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/ips-corroborated.txt

Full URLs (corroborated) Corroborated

urls.txt entries also listed by URLhaus, ThreatFox, MalwareBazaar, USOM or IPsum.

/v1/blocklist/urls-corroborated.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/urls-corroborated.txt

Palo Alto Networks (PAN-OS EDL): point a Domain EDL at domains.txt with Automatically expand to include subdomains ticked and an Hourly refresh interval; the file changes at most every 15 minutes, so polling faster buys little. Point an IP EDL at ips.txt; comment lines are documented for IP EDLs and are skipped as non-matching entries. Do not use urls.txt as a URL EDL: PAN-OS reads ? & = ; + as wildcard/token separators, which breaks full-path indicators.

Hashes and newly registered

Two more angles on the same 30-day feed: file hashes for EDR/AV bulk import, and a newly-registered-plus-reported subset for DNS filters.

SHA-256 hashes EDR/AV

One lowercase hex SHA-256 per line. For Microsoft Defender for Endpoint's Indicators CSV import, CrowdStrike IOC management or any EDR/AV custom-indicator bulk import. About 300 hashes today - smaller than the domain/URL lists, since researchers tweet fewer hashes.

/v1/blocklist/sha256.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/sha256.txt

MD5 hashes EDR/AV

One lowercase hex MD5 per line, same use case as sha256.txt for tools that still key on MD5. About 130 hashes today.

/v1/blocklist/md5.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/md5.txt

Newly registered domains NRD

domains.txt entries whose registrable apex was created 30 days or less before TweetFeed's first report (RDAP creation date). Only apexes with a known RDAP creation date are considered (about 6 in 10 reported domains), and a domain reported this tick can appear one tick later since the registration check runs after publish - a supplement to domains.txt, not a complete NRD feed.

/v1/blocklist/nrd-domains.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/nrd-domains.txt

What a response looks like

Most files open with a header comment giving their own generation timestamp and live entry count, then one indicator per line. domains.txt shown here. rpz.txt is a BIND zone file instead of a flat list; zeek-intel.txt opens with a single tab-separated #fields line instead; the wazuh-*.txt files carry no header at all, since a # would compile as a literal CDB key. adguard.txt carries AdGuard/uBlock filter-list metadata (! Title:, ! Homepage:, ! License:, ! Expires:, etc.) instead of the generic # header; nrd-domains.txt adds extra header lines naming its base list and cross-check refresh time.

# TweetFeed blocklist - plain domain list (Pi-hole compatible)
# Window: 30 days
# Entries: 4877
# Updated: 2026-08-22T12:45:18Z
# License: CC0
# Source: https://api.tweetfeed.live/v1/blocklist/domains.txt
# https://tweetfeed.live
# Community-reported IOCs. Use at your own risk.

000.rich
0000110720265.sbs
00004444444022.net
...

Window and refresh

  • Rolling 30-day window: an entry drops off 30 days after it was last reported, not 30 days after you last downloaded the file.
  • Rebuilt every 15 minutes, in step with the rest of the TweetFeed pipeline; a file only changes on disk when its entries change.
  • Every file supports conditional requests (curl -z <local-file> / wget --timestamping): a 304 with no body comes back when nothing changed since your last pull.
  • 1:1 mirror of the main feed, with no additional quality gate - the same OSINT caveats as the rest of the site apply.

Frequently asked questions

What is an IOC blocklist?

An IOC blocklist is a plain-text export of malicious indicators formatted for direct import into one specific tool: a DNS sinkhole, an ad blocker, a resolver zone file or a firewall rule set. TweetFeed publishes several such exports, rebuilt every 15 minutes from the same underlying feed the rest of the site uses.

Which format should I use?

Pi-hole and most DNS sinkholes take domains.txt. AdGuard Home and uBlock-style filter lists take adguard.txt, a valid AdGuard/uBlock filter list with a ! metadata header. dnsmasq, including OpenWrt and pfSense, takes dnsmasq.txt. A resolver that supports Response Policy Zones - BIND, Unbound, PowerDNS Recursor - takes rpz.txt. A firewall or edge ACL takes ips.txt. Anything that reads a plain hosts file, including some routers, takes hosts.txt. A SIEM, proxy or IDS that needs to match the full path, not just the host, takes urls.txt. Zeek's Intelligence Framework takes zeek-intel.txt. A Wazuh manager takes wazuh-domains.txt and wazuh-ips.txt as CDB lists. If you want a smaller, corroborated starting point instead, see domains-corroborated.txt / ips-corroborated.txt / urls-corroborated.txt below. EDR/AV bulk import takes sha256.txt / md5.txt. A newly-registered-plus-reported DNS filter feed takes nrd-domains.txt.

How often are the blocklists updated?

Every 15 minutes, in step with the rest of the TweetFeed pipeline, though a given file only changes on disk when its entries actually change. Each file's own header comment carries the exact generation timestamp and entry count for that fetch.

What time window do these cover?

A rolling 30-day window. An entry drops off the list 30 days after it was last reported, independent of when you last downloaded the file.

Are these safe to import directly?

They are the same community-reported IOCs as the rest of TweetFeed, with no additional quality gate. Use them as a starting blocklist and validate before wide deployment. They also work well as a watchlist or threat-hunting input in cases where you are not comfortable blocking on them outright.

Is this free to use?

Yes. Every blocklist file is CC0 1.0 Universal, the same license as the rest of TweetFeed's data. No API key, sign-up or rate limit; commercial use is allowed.

Can I automate downloading these blocklists?

Yes. Each file supports conditional requests: send curl -z <local-file> or wget --timestamping and you get a 304 with no body when nothing has changed since your last pull, so a cron job can poll every 15 minutes without re-downloading the full file each time.

License

Source code for the pipeline: github.com/0xDanielLopez/TweetFeed (MIT).