Blocklists

Ready-to-import plain-text blocklists for Pi-hole, AdGuard, dnsmasq, RPZ resolvers, firewalls and SIEMs

Blocklists

Plain-text blocklists for Pi-hole, AdGuard, dnsmasq, RPZ, firewalls and SIEMs

Related Threat Intelligence feeds: malicious domains · URLs · malicious IP list · CSV/JSON feeds · All IOC types

The blocklist formats

Ready-to-consume exports of the last 30 days, one file per consumer format.
Rebuilt every 15 minutes, but a file only changes when its entries change.
Every file is CC0, with no API key or sign-up.
Same community-reported IOCs as the rest of TweetFeed.
No additional quality gate.

Domain list Pi-hole

Pi-hole, and anything that takes one bare domain per line.

/v1/blocklist/domains.txt

curl -sfL https://api.tweetfeed.live/v1/blocklist/domains.txt

hosts file any /etc/hosts reader

/etc/hosts, Windows hosts file, some routers.

/v1/blocklist/hosts.txt

curl -sfL https://api.tweetfeed.live/v1/blocklist/hosts.txt

AdGuard rules AdGuard

AdGuard Home and uBlock-style filter lists.
Valid AdGuard/uBlock filter list.
It has a ! metadata header (Title/Homepage/License/Expires).
Not the generic # header the other files use.

/v1/blocklist/adguard.txt

curl -sfL https://api.tweetfeed.live/v1/blocklist/adguard.txt

IP list firewall

Firewalls and edge ACLs.

/v1/blocklist/ips.txt

curl -sfL https://api.tweetfeed.live/v1/blocklist/ips.txt

DNS RPZ zone RPZ resolver

BIND, Unbound, PowerDNS Recursor.

/v1/blocklist/rpz.txt

curl -sfL https://api.tweetfeed.live/v1/blocklist/rpz.txt

dnsmasq config dnsmasq

dnsmasq, including OpenWrt and pfSense.

/v1/blocklist/dnsmasq.txt

curl -sfL https://api.tweetfeed.live/v1/blocklist/dnsmasq.txt

Full URLs SIEM

Proxies, IDS, SIEM/SOAR enrichment - matches on path, not just host.

/v1/blocklist/urls.txt

curl -sfL https://api.tweetfeed.live/v1/blocklist/urls.txt

The DNS/host formats block at that level.
urls.txt is one full URL per line instead.
So it also covers url-type IOCs on shared infrastructure.
DNS blocking cannot safely reach those, or other legitimate infrastructure.

IDS and SIEM

Formats for intrusion detection and log correlation tooling.
A tab-separated Zeek Intelligence Framework file.
In it, meta.source is always tweetfeed.live.
Two Wazuh CDB lists.
Same rolling 30-day window, same CC0 license.
None of the three carries a header comment.
Zeek parses every non-#fields line as data.
A Wazuh CDB would compile a # as a literal key.
Check freshness via /v1/manifest or the Last-Modified header.

Zeek intel file Zeek

Zeek's Intelligence Framework, loaded with redef Intel::read_files.

/v1/blocklist/zeek-intel.txt

curl -sfL https://api.tweetfeed.live/v1/blocklist/zeek-intel.txt

Wazuh domains CDB Wazuh

Wazuh CDB list for a rule with lookup="match_key" on a domain field.

/v1/blocklist/wazuh-domains.txt

curl -sfL https://api.tweetfeed.live/v1/blocklist/wazuh-domains.txt

Wazuh IPs CDB Wazuh

Wazuh CDB list for a rule with lookup="address_match_key" on srcip/dstip.

/v1/blocklist/wazuh-ips.txt

curl -sfL https://api.tweetfeed.live/v1/blocklist/wazuh-ips.txt

Corroborated subsets

Subset of domains.txt / ips.txt / urls.txt.
Also listed by at least one of URLhaus, ThreatFox, MalwareBazaar, USOM or IPsum.
Measured at the last 6-hourly cross-check.
If change control won't deploy a single-reporter community list, start here.
The base lists above remain the full feed.
Set membership only: not a quality score, not a verdict.

Domain list (corroborated) Corroborated

domains.txt entries also listed by URLhaus, ThreatFox, MalwareBazaar, USOM or IPsum.

/v1/blocklist/domains-corroborated.txt

curl -sfL https://api.tweetfeed.live/v1/blocklist/domains-corroborated.txt

IP list (corroborated) Corroborated

ips.txt entries also listed by URLhaus, ThreatFox, MalwareBazaar, USOM or IPsum.

/v1/blocklist/ips-corroborated.txt

curl -sfL https://api.tweetfeed.live/v1/blocklist/ips-corroborated.txt

Full URLs (corroborated) Corroborated

urls.txt entries also listed by URLhaus, ThreatFox, MalwareBazaar, USOM or IPsum.

/v1/blocklist/urls-corroborated.txt

curl -sfL https://api.tweetfeed.live/v1/blocklist/urls-corroborated.txt

Palo Alto Networks (PAN-OS EDL): point a Domain EDL at domains.txt.
Tick Automatically expand to include subdomains.
Set an Hourly refresh interval.
The file changes at most every 15 minutes, so polling faster buys little.
Point an IP EDL at ips.txt.
Comment lines are documented for IP EDLs and skipped as non-matching entries.
Do not use urls.txt as a URL EDL.
PAN-OS reads ? & = ; + as wildcard/token separators.
That breaks full-path indicators.

Hashes and newly registered

Two more angles on the same 30-day feed:
file hashes for EDR/AV bulk import,
and a newly-registered-plus-reported subset for DNS filters.

SHA-256 hashes EDR/AV

One lowercase hex SHA-256 per line.
For Microsoft Defender for Endpoint's Indicators CSV import.
For CrowdStrike IOC management.
Or for any EDR/AV custom-indicator bulk import.
About 300 hashes today.
Smaller than the domain/URL lists, since researchers tweet fewer hashes.

/v1/blocklist/sha256.txt

curl -sfL https://api.tweetfeed.live/v1/blocklist/sha256.txt

MD5 hashes EDR/AV

One lowercase hex MD5 per line, same use case as sha256.txt for tools that still key on MD5. About 130 hashes today.

/v1/blocklist/md5.txt

curl -sfL https://api.tweetfeed.live/v1/blocklist/md5.txt

Newly registered domains NRD

Subset of domains.txt with a young registrable apex.
Young: created 30 days or less before TweetFeed's first report.
Source: the RDAP creation date.
Only apexes with a known RDAP creation date are considered.
That is about 6 in 10 reported domains.
A domain reported this tick can appear one tick later.
The registration check runs after publish.
A supplement to domains.txt, not a complete NRD feed.

/v1/blocklist/nrd-domains.txt

curl -sfL https://api.tweetfeed.live/v1/blocklist/nrd-domains.txt

What a response looks like

Most files open with a header comment, then one indicator per line.
The header gives the file's own generation timestamp and live entry count.
domains.txt is shown here.
rpz.txt is a BIND zone file instead of a flat list.
zeek-intel.txt opens with a single tab-separated #fields line.
The wazuh-*.txt files carry no header at all.
A # would compile as a literal CDB key.
adguard.txt carries AdGuard/uBlock filter-list metadata.
It replaces the generic # header.
Example fields: ! Title:, ! Homepage:, ! License:, ! Expires:, etc.
nrd-domains.txt adds extra header lines.
They name its base list and cross-check refresh time.

# TweetFeed blocklist - plain domain list (Pi-hole compatible)
# Window: 30 days
# Entries: 4877
# Updated: 2026-08-22T12:45:18Z
# License: CC0
# Source: https://api.tweetfeed.live/v1/blocklist/domains.txt
# https://tweetfeed.live
# Community-reported IOCs. Use at your own risk.

000.rich
0000110720265.sbs
00004444444022.net
...

Window and refresh

Rolling 30-day window.
- An entry drops off 30 days after it was last reported.
- Not 30 days after you last downloaded the file.
Rebuilt every 15 minutes, in step with the rest of the TweetFeed pipeline.
- A file only changes on disk when its entries change.
Every file supports conditional requests (curl -z <local-file> / wget --timestamping).
- A 304 with no body comes back when nothing changed since your last pull.
1:1 mirror of the main feed, with no additional quality gate.
- The same OSINT caveats as the rest of the site apply.

Frequently asked questions

What is an IOC blocklist?

An IOC blocklist is a plain-text export of malicious indicators formatted for direct import into one specific tool: a DNS sinkhole, an ad blocker, a resolver zone file or a firewall rule set. TweetFeed publishes several such exports, rebuilt every 15 minutes from the same underlying feed the rest of the site uses.

Which format should I use?

Pi-hole and most DNS sinkholes take domains.txt. AdGuard Home and uBlock-style filter lists take adguard.txt, a valid AdGuard/uBlock filter list with a ! metadata header. dnsmasq, including OpenWrt and pfSense, takes dnsmasq.txt. A resolver that supports Response Policy Zones - BIND, Unbound, PowerDNS Recursor - takes rpz.txt. A firewall or edge ACL takes ips.txt. Anything that reads a plain hosts file, including some routers, takes hosts.txt. A SIEM, proxy or IDS that needs to match the full path, not just the host, takes urls.txt. Zeek's Intelligence Framework takes zeek-intel.txt. A Wazuh manager takes wazuh-domains.txt and wazuh-ips.txt as CDB lists. If you want a smaller, corroborated starting point instead, see domains-corroborated.txt / ips-corroborated.txt / urls-corroborated.txt below. EDR/AV bulk import takes sha256.txt / md5.txt. A newly-registered-plus-reported DNS filter feed takes nrd-domains.txt.

How often are the blocklists updated?

Every 15 minutes, in step with the rest of the TweetFeed pipeline, though a given file only changes on disk when its entries actually change. Each file's own header comment carries the exact generation timestamp and entry count for that fetch.

What time window do these cover?

A rolling 30-day window. An entry drops off the list 30 days after it was last reported, independent of when you last downloaded the file.

Are these safe to import directly?

They are the same community-reported IOCs as the rest of TweetFeed, with no additional quality gate. Use them as a starting blocklist and validate before wide deployment. They also work well as a watchlist or threat-hunting input in cases where you are not comfortable blocking on them outright.

Is this free to use?

Yes. Every blocklist file is CC0 1.0 Universal, the same license as the rest of TweetFeed's data. No API key, sign-up or rate limit; commercial use is allowed.

Can I automate downloading these blocklists?

Yes. Each file supports conditional requests: send curl -z <local-file> or wget --timestamping and you get a 304 with no body when nothing has changed since your last pull, so a cron job can poll every 15 minutes without re-downloading the full file each time.

License

IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.