HaGeZi Threat Intelligence Feeds

[ghost]

Prerequisites

• [X] The blocklist is created specifically for DNS-level blockers;
• [X] The blocklist is regularly updated (at least 10 updates per month);
• [X] The blocklist is known and popular;
• [X] The blocklist satisfies the repo requirements;

Blocklist name

Threat Intelligence Feeds

Blocklist category

Malware&phishing blocking

Homepage

https://gitlab.com/hagezi/mirror/-/raw/main/dns-blocklists/domains/tif.txt

Explanation

Add to the security filters

[hagezi]

@ameshkov If you want to add the list, use the AdBlock format: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/tif.txt

[rahaaatul]

@ameshkov If you want to add the list, use the AdBlock format: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/tif.txt

Hagezi, If I want to use your filter lists in AdGuard for Android app? Which one should I use? Because I tried adding the ultimate/pro plus/pro hosts in DNS filter but AdGuard only support upto 20 mb file size in there, so I couldn't add the hosts file. But the wildcards have no issue getting installed, but do they work same way as the hosts file? I want to add your lists in DNS level, so what's your recommendation for AdGuard for Android app user?

[hagezi]

@rahaaatul Use the AdBlock format for AdGuard.

[rahaaatul]

@rahaaatul Use the AdBlock format for AdGuard.

Hey @hagezi , thank you for replying.

I've installed the AdBlock format. Are they better than DNS blocking? Or not?

I have another question to ask, if you don't mind replying is, you wrote this in your GitHub ,

Prevent method to bypass your DNS. To ensure the bootstrap is your DNS server you must redirect or block standard DNS outbound (TCP/UDP 53) and block all DNS over TLS (TCP 853) outbound.

What did you mean by this? And how do I do it on AdGuard app?

Is this the settings for that?

If so, what should I add here?

[hagezi]

@ameshkov @Alex-302 @Sergey-Lyapin

Is there a chance that the TIF list will be added to AdGuard-DNS? I think it is an improvement. I put a lot of effort into ridding it of false positives and implemented some mechanisms in the build to keep it that way. Among other things, I use top lists from Umbrella and Co. The list summarises all the threat intelligence feeds worth mentioning and is regularly cleared of inactive/dead domains.

Which sources are used and statistics from the build can be seen here: https://github.com/hagezi/dns-blocklists/blob/main/statistics.md#tif

Thank you, Gerd