Blocklists

Ready-to-import plain-text blocklists for Pi-hole, AdGuard, dnsmasq, RPZ resolvers, firewalls and SIEMs


Blocklists

Plain-text blocklists for Pi-hole, AdGuard, dnsmasq, RPZ, firewalls and SIEMs

Related Threat Intelligence feeds: malicious domains · URLs · malicious IP list · CSV/JSON feeds · All IOC types

The seven formats

Ready-to-consume exports of the last 30 days, one file per consumer format. Rebuilt every 15 minutes, but a file only changes when its entries change. Every file is CC0 with no API key or sign-up - these are the same community-reported IOCs as the rest of TweetFeed, with no additional quality gate.

Domain list Pi-hole

Pi-hole, and anything that takes one bare domain per line.

/v1/blocklist/domains.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/domains.txt

hosts file any /etc/hosts reader

/etc/hosts, Windows hosts file, some routers.

/v1/blocklist/hosts.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/hosts.txt

AdGuard rules AdGuard

AdGuard Home and uBlock-style filter lists.

/v1/blocklist/adguard.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/adguard.txt

IP list firewall

Firewalls and edge ACLs.

/v1/blocklist/ips.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/ips.txt

DNS RPZ zone RPZ resolver

BIND, Unbound, PowerDNS Recursor.

/v1/blocklist/rpz.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/rpz.txt

dnsmasq config dnsmasq

dnsmasq, including OpenWrt and pfSense.

/v1/blocklist/dnsmasq.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/dnsmasq.txt

Full URLs SIEM

Proxies, IDS, SIEM/SOAR enrichment - matches on path, not just host.

/v1/blocklist/urls.txt 

curl -sfL https://api.tweetfeed.live/v1/blocklist/urls.txt

The first six block at DNS or host level. urls.txt is one full URL per line instead, so it also covers url-type IOCs on shared or otherwise legitimate infrastructure that DNS-level blocking cannot safely reach.

What a response looks like

Every file opens with a header comment giving its own generation timestamp and live entry count, then one indicator per line. domains.txt shown here; rpz.txt is the one exception, formatted as a full BIND zone file instead of a flat list.

# TweetFeed blocklist - plain domain list (Pi-hole compatible)
# Window: 30 days
# Entries: 4877
# Updated: 2026-08-22T12:45:18Z
# License: CC0
# Source: https://api.tweetfeed.live/v1/blocklist/domains.txt
# https://tweetfeed.live
# Community-reported IOCs. Use at your own risk.

000.rich
0000110720265.sbs
00004444444022.net
...

Window and refresh

  • Rolling 30-day window: an entry drops off 30 days after it was last reported, not 30 days after you last downloaded the file.
  • Rebuilt every 15 minutes, in step with the rest of the TweetFeed pipeline; a file only changes on disk when its entries change.
  • Every file supports conditional requests (curl -z <local-file> / wget --timestamping): a 304 with no body comes back when nothing changed since your last pull.
  • 1:1 mirror of the main feed, with no additional quality gate - the same OSINT caveats as the rest of the site apply.

Frequently asked questions

What is an IOC blocklist?

An IOC blocklist is a plain-text export of malicious indicators formatted for direct import into one specific tool: a DNS sinkhole, an ad blocker, a resolver zone file or a firewall rule set. TweetFeed publishes seven such exports, rebuilt every 15 minutes from the same underlying feed the rest of the site uses.

Which format should I use?

Pi-hole and most DNS sinkholes take domains.txt. AdGuard Home and uBlock-style filter lists take adguard.txt. dnsmasq, including OpenWrt and pfSense, takes dnsmasq.txt. A resolver that supports Response Policy Zones - BIND, Unbound, PowerDNS Recursor - takes rpz.txt. A firewall or edge ACL takes ips.txt. Anything that reads a plain hosts file, including some routers, takes hosts.txt. A SIEM, proxy or IDS that needs to match the full path, not just the host, takes urls.txt.

How often are the blocklists updated?

Every 15 minutes, in step with the rest of the TweetFeed pipeline, though a given file only changes on disk when its entries actually change. Each file's own header comment carries the exact generation timestamp and entry count for that fetch.

What time window do these cover?

A rolling 30-day window. An entry drops off the list 30 days after it was last reported, independent of when you last downloaded the file.

Are these safe to import directly?

They are the same community-reported IOCs as the rest of TweetFeed, with no additional quality gate. Use them as a starting blocklist and validate before wide deployment. They also work well as a watchlist or threat-hunting input in cases where you are not comfortable blocking on them outright.

Is this free to use?

Yes. Every blocklist file is CC0 1.0 Universal, the same license as the rest of TweetFeed's data. No API key, sign-up or rate limit; commercial use is allowed.

Can I automate downloading these blocklists?

Yes. Each file supports conditional requests: send curl -z <local-file> or wget --timestamping and you get a 304 with no body when nothing has changed since your last pull, so a cron job can poll every 15 minutes without re-downloading the full file each time.

License

Source code for the pipeline: github.com/0xDanielLopez/TweetFeed (MIT).