safing-intel-data/lists/sources.yml

version: "v2021.12.1"
schemaVersion: "v2.0.0"
categories:
  - name: "Ads & Trackers"
    id: "TRAC"
    description: "Services that track and profile people online."
  - name: "Ads"
    id: "ADS"
    description: "Services that serve ads and track their audiences."
    parent: "TRAC"
  - name: "Analytics"
    id: "ALYTC"
    description: "Services that provide visitor analysis/profiling."
    parent: "TRAC"
  - name: "Telemetry"
    id: "TELEM"
    description: "Services that collect application telemetry."
    parent: "TRAC"
  - name: "Other"
    id: "TRACO"
    description: "Services that are believed to serve ads or track users, but their exact use is unknown or not categorized."
    parent: "TRAC"

  - name: "Malware"
    id: "MAL"
    description: "Services that are (ab)used for attacking devices through technical means."

  - name: "Deception"
    id: "DECEP"
    description: "Services that trick humans into thinking the service is genuine, while it is not. There is no malware involved."
  - name: "Phishing"
    id: "PHISH"
    description: "Services that engage in password fishing."
    parent: "DECEP"
  - name: "Fraud"
    id: "FRAUD"
    description: "Services that scam people."
    parent: "DECEP"

  - name: "Mixed Ads/Trackers/Malware"
    id: "BAD"
    description: "Services that are harmful to security or privacy. These lists mix different categories which makes it hard to categorize them. See individual descriptions for more information."

  - name: "NSFW"
    id: "NSFW"
    description: "Services that are generally not accepted in work environments."
  - name: "Pornography"
    id: "PORN"
    description: "Services that provide pornographic content."
    parent: "NSFW"
  - name: "Violence"
    id: "VIOL"
    description: "Services that provide graphic depictions of violence. May include things like gore, fighting, or weapons."
    parent: "NSFW"
  - name: "Gambling"
    id: "GAMBL"
    description: "Services that provide pornographic content in addition to other content that is safe for work."
    parent: "NSFW"
  - name: "Mixed"
    id: "NSFWM"
    description: "Services that are generally not accepted in work environments."
    parent: "NSFW"

  - name: "Experiments"
    id: "EXPERIMENTS"
    description: "Experimental lists of various categories that are being evaluated and might easily break websites and applications. Feedback on these lists is very welcome."

sources:
  - name: "AdAway Ads List"
    id: "AA-AD"
    description: "Ads list by AdAway - an open source ad blocker for Android."
    category: "ADS"
    urls:
    - url: "https://raw.githubusercontent.com/AdAway/adaway.github.io/master/hosts.txt"
      type: "Domain"
      parser: "hostsfile"
    website: "https://adaway.org/"
    contribute: "https://github.com/AdAway/AdAway/issues"
    license: "CC BY 3.0"

  - name: "CoinBlocker"
    id: "CB-MW"
    description: "Collection of Domain used by cryptominers"
    category: "EXPERIMENTS"
    urls:
    - url: "https://zerodot1.gitlab.io/CoinBlockerLists/list.txt"
      type: "Domain"
      parser: "domainlist"
    website: "https://zerodot1.gitlab.io/CoinBlockerListsWeb/"
    contribute: "https://gitlab.com/ZeroDot1/CoinBlockerLists/issues"
    license: AGPLv3

  - name: "Dan Pollock's List of Bad Stuff - someonewhocares.org"
    id: "SWC"
    description: "List of miscellaneous bad stuff by Dan Pollock."
    category: "BAD"
    urls:
    - url: "https://someonewhocares.org/hosts/zero/hosts"
      type: "Domain"
      parser: "hostsfile"
    website: "https://someonewhocares.org/hosts/"
    contribute: "hosts@someonewhocares.org"
    license: "You are free to copy and distribute this file for non-commercial uses, as long the original url and attribution is included."

  - name: "Disconnect.me Tracking Domains"
    id: "DM-TR"
    description: "Basic tracking list by Disconnect.me."
    category: "ALYTC"
    urls:
    - url: "https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt"
      type: "Domain"
      parser: "domainlist"
    website: "https://disconnect.me/"
    license: "GPLv3"

  - name: "Disconnect.me Ad Domains"
    id: "DM-AD"
    description: "Basic ad filter list by Disconnect.me."
    category: "ADS"
    urls:
    - url: "https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt"
      type: "Domain"
      parser: "domainlist"
    website: "https://disconnect.me/"
    license: "GPLv3"

  - name: "hostsVN Ads List (Vietnam)"
    id: "BD-AD"
    description: "hostsVN's collection of ad services, with a local focus on Vietnam."
    category: "ADS"
    urls:
    - url: "https://raw.githubusercontent.com/bigdargon/hostsVN/master/option/hosts-VN"
      type: "Domain"
      parser: "hostsfile"
    website: "https://bigdargon.github.io/hostsVN/"
    contribute: "https://github.com/bigdargon/hostsVN/issues"
    license: "MIT"

  - name: "hostsVN Gambling List (Vietnam)"
    id: "BD-G"
    description: "hostsVN's collection of gambling websites, with a local focus on Vietnam."
    category: "GAMBL"
    urls:
    - url: "https://raw.githubusercontent.com/bigdargon/hostsVN/master/option/hosts-gambling"
      type: "Domain"
      parser: "hostsfile"
    website: "https://bigdargon.github.io/hostsVN/"
    contribute: "https://github.com/bigdargon/hostsVN/issues"
    license: "MIT"

  - name: "Malware Domain List .com"
    id: "MDLC"
    description: "Malware Domain List is a non-commercial community project."
    category: "MAL"
    urls:
    - url: "https://www.malwaredomainlist.com/hostslist/hosts.txt"
      type: "Domain"
      parser: "hostsfile"
    website: "https://www.malwaredomainlist.com/"
    contribute: "https://www.malwaredomainlist.com/contact.php"
    license: "Our list can be used for free by anyone. Feel free to use it."

  - name: "MVPS Hosts File"
    id: "MVPS"
    description: "List of ads, malware and other things."
    category: "BAD"
    urls:
    - url: "http://winhelp2002.mvps.org/hosts.zip"
      type: "Domain"
      parser: "hostsfile"
      transformer:
        type: "unzip"
        args:
          file: hosts
    website: "http://winhelp2002.mvps.org/hosts.htm"
    contribute: "mailto:winhelp2002@gmail.com"
    license: "CC-BY-NC-SA-4.0"

  - name: "Peter Lowe's Collection of Bad Domains"
    id: "PL-B"
    description: "List of ad, malware, tracking, anti-adblock and other nasty services."
    category: "BAD"
    urls:
    - url: "https://pgl.yoyo.org/adservers/serverlist.php?hostformat=nohtml&mimetype=plaintext"
      type: "Domain"
      parser: "domainlist"
    website: "https://pgl.yoyo.org/adservers"
    contribute: "https://pgl.yoyo.org/as/#submit"
    license: "?"

  - name: "Pornhosts - Niclas' Pornography List"
    id: "NI-PH"
    description: "Niclas' Pornhosts is an endeavour to find all porn Domain."
    category: "PORN"
    urls:
    - url: "https://raw.githubusercontent.com/Clefspeare13/pornhosts/master/0.0.0.0/hosts"
      type: "Domain"
      parser: "hostsfile"
    website: "https://github.com/Clefspeare13/pornhosts"
    contribute: "https://github.com/Clefspeare13/pornhosts/issues"
    license: MIT

  - name: "Sinfonietta's Gambling List"
    id: "SFA-G"
    description: "Sinfonietta's collection of gambling websites."
    category: "GAMBL"
    urls:
    - url: "https://raw.githubusercontent.com/Sinfonietta/hostfiles/master/gambling-hosts"
      type: "Domain"
      parser: "hostsfile"
    website: "https://github.com/Sinfonietta/hostfiles"
    contribute: "https://github.com/Sinfonietta/hostfiles/issues"
    license: MIT

  - name: "Sinfonietta's Gore List"
    id: "SFA-V"
    description: "Sinfonietta's collection of gore websites."
    category: "VIOL"
    urls:
    - url: "https://raw.githubusercontent.com/Sinfonietta/hostfiles/master/snuff-hosts"
      type: "Domain"
      parser: "hostsfile"
    website: "https://github.com/Sinfonietta/hostfiles"
    contribute: "https://github.com/Sinfonietta/hostfiles/issues"
    license: MIT

  - name: "Sinfonietta's Pornography List"
    id: "SFA-P"
    description: "Sinfonietta's collection of pornography websites."
    category: "PORN"
    urls:
    - url: "https://raw.githubusercontent.com/Sinfonietta/hostfiles/master/pornography-hosts"
      type: "Domain"
      parser: "hostsfile"
    website: "https://github.com/Sinfonietta/hostfiles"
    contribute: "https://github.com/Sinfonietta/hostfiles/issues"
    license: MIT

  - name: "Steven Black's Ads and Malware Collection"
    id: "SB-AM"
    description: "Collection of many ads and malware Domain."
    category: "BAD"
    urls:
    - url: "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"
      type: "Domain"
      parser: "hostsfile"
    website: "https://github.com/StevenBlack/hosts"
    contribute: "https://github.com/StevenBlack/hosts/issues"
    license: "MIT"

  - name: "Steven Black's Original Ad-Hoc List"
    id: "SB-AH"
    description: "Miscellaneous sketch Domain Steven Black comes across."
    category: "BAD"
    urls:
    - url: "https://raw.githubusercontent.com/StevenBlack/hosts/master/data/StevenBlack/hosts"
      type: "Domain"
      parser: "hostsfile"
    website: "https://github.com/StevenBlack/hosts/blob/master/data/StevenBlack/hosts"
    contribute: "https://github.com/StevenBlack/hosts/issues"
    license: "MIT"

  - name: "Tiuxo's Ads List (Japan)"
    id: "TX-AD"
    description: "Tiuxo's collection of ad services, with a local focus on Japan."
    category: "ADS"
    urls:
    - url: "https://raw.githubusercontent.com/tiuxo/hosts/master/ads"
      type: "Domain"
      parser: "hostsfile"
    website: "https://github.com/tiuxo/hosts"
    contribute: "https://github.com/tiuxo/hosts/issues"
    license: "CC-BY-4.0"

  - name: "Tiuxo's Pornography List (Japan)"
    id: "TX-PRN"
    description: "Tiuxo's collection of pornography websites, with a local focus on Japan"
    category: "PORN"
    urls:
    - url: "https://raw.githubusercontent.com/tiuxo/hosts/master/porn"
      type: "Domain"
      parser: "hostsfile"
    website: "https://github.com/tiuxo/hosts"
    contribute: "https://github.com/tiuxo/hosts/issues"
    license: "CC-BY-4.0"

  - name: "Safing Ads List"
    id: "17-ADS"
    description: "Services that serve ads and track their audiences."
    category: "ADS"
    urls:
    - url: "https://raw.githubusercontent.com/safing/intel-data/master/lists/ads.txt"
      type: "Domain"
      parser: "domainlist"
    website: "https://github.com/safing/intel-data"
    contribute: "https://github.com/safing/intel-data"
    license: "CC-BY-SA-4.0"

  - name: "Safing Analytics List"
    id: "17-ALYTC"
    description: "Services that provide visitor analysis/profiling."
    category: "ALYTC"
    urls:
    - url: "https://raw.githubusercontent.com/safing/intel-data/master/lists/analytics.txt"
      type: "Domain"
      parser: "domainlist"
    website: "https://github.com/safing/intel-data"
    contribute: "https://github.com/safing/intel-data"
    license: "CC-BY-SA-4.0"

  - name: "Safing Fraud List"
    id: "17-FRD"
    description: "Services that scam people."
    category: "FRAUD"
    urls:
    - url: "https://raw.githubusercontent.com/safing/intel-data/master/lists/fraud.txt"
      type: "Domain"
      parser: "domainlist"
    website: "https://github.com/safing/intel-data"
    contribute: "https://github.com/safing/intel-data"
    license: "CC-BY-SA-4.0"

  - name: "Safing Malware List"
    id: "17-MAL"
    description: "Services that are (ab)used for attacking devices through technical means."
    category: "MAL"
    urls:
    - url: "https://raw.githubusercontent.com/safing/intel-data/master/lists/malware.txt"
      type: "Domain"
      parser: "domainlist"
    website: "https://github.com/safing/intel-data"
    contribute: "https://github.com/safing/intel-data"
    license: "CC-BY-SA-4.0"

  - name: "Safing Phishing List"
    id: "17-PSH"
    description: "Services that engage in credential fishing."
    category: "PHISH"
    urls:
    - url: "https://raw.githubusercontent.com/safing/intel-data/master/lists/phishing.txt"
      type: "Domain"
      parser: "domainlist"
    website: "https://github.com/safing/intel-data"
    contribute: "https://github.com/safing/intel-data"
    license: "CC-BY-SA-4.0"

  - name: "Safing Telemetry List"
    id: "17-TEL"
    description: "Services that collect application telemetry."
    category: "TELEM"
    urls:
    - url: "https://raw.githubusercontent.com/safing/intel-data/master/lists/telemetry.txt"
      type: "Domain"
      parser: "domainlist"
    website: "https://github.com/safing/intel-data"
    contribute: "https://github.com/safing/intel-data"
    license: "CC-BY-SA-4.0"

  - name: "Safing Tracking List"
    id: "17-TRACO"
    description: "Services that are believed to serve ads or track users, but their exact use is unknown or not categorized."
    category: "TRACO"
    urls:
    - url: "https://raw.githubusercontent.com/safing/intel-data/master/lists/tracking-other.txt"
      type: "Domain"
      parser: "domainlist"
    website: "https://github.com/safing/intel-data"
    contribute: "https://github.com/safing/intel-data"
    license: "CC-BY-SA-4.0"

  - name: "Windows Spy Blocker"
    id: "WSP"
    description: "Services that Windows uses for telemetry and related activity."
    category: "EXPERIMENTS"
    urls:
    - url: "https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/spy.txt"
      type: "Domain"
      parser: "hostsfile"
    website: "https://github.com/crazy-max/WindowsSpyBlocker"
    contribute: "https://github.com/crazy-max/WindowsSpyBlocker/issues"
    license: "MIT"

  - name: "Abuse.ch URLHaus Domains"
    id: "UH-D"
    description: "Services that are malicious and deceptive, possibly hacked and abused. Possibility of false positives."
    category: "MAL"
    urls:
    - url: "https://urlhaus.abuse.ch/downloads/hostfile/"
      type: "Domain"
      parser: "hostsfile"
    website: "https://urlhaus.abuse.ch/"
    contribute: "https://urlhaus.abuse.ch/api/"
    license: "CC0-1.0"

  - name: "Abuse.ch FEODO Blocklist"
    id: "AC-FE"
    description: "Blocklist of IP addresses that are associated with Dridex, Heodo (aka Emotet) and TrickBot botnet C&Cs"
    category: "MAL"
    urls:
    - url: "https://feodotracker.abuse.ch/downloads/ipblocklist.txt"
      type: "IPv4"
      parser: "hostsfile"
    website: "https://feodotracker.abuse.ch/"
    license: "CC0-1.0"

  # DShield.org Suspicious Domain List
  # Currently suspended.
  # See https://dshield.org/suspicious_domains.html

  - name: "DNS-BH - Malware Domain Blocklist by RiskAnalytics"
    id: "DNSBH-D"
    description: "Services that are suspicious and are likely to engage in malicious activity."
    category: "MAL"
    urls:
    - url: "http://mirror1.malwaredomains.com/files/domains.txt"
      type: "Domain"
      parser: "domainlist-firstcolumn"
    website: "http://www.malwaredomains.com/"
    contribute: "http://www.malwaredomains.com/?page_id=13"
    license: "free for noncommercial use"

  - name: "DNS-BH - Immortal Malware Domain Blocklist by RiskAnalytics"
    id: "DNSBH-I"
    description: "Services that are suspicious and are likely to engage in malicious activity. This list contains domains that have lived for a long time."
    category: "MAL"
    urls:
    - url: "http://mirror1.malwaredomains.com/files/immortal_domains.txt"
      type: "Domain"
      parser: "domainlist"
    website: "http://www.malwaredomains.com/"
    contribute: "http://www.malwaredomains.com/?page_id=13"
    license: "free for noncommercial use"

  - name: "Safing Special List: Secure DNS Resolvers"
    id: "17-DNS"
    description: "Services that provide secure DNS resolvers that could be used to bypass the Portmaster."
    urls:
      - url: "https://raw.githubusercontent.com/safing/intel-data/master/lists/securedns.txt"
        type: "Domain"
        parser: "domainlist"
      - url: "https://raw.githubusercontent.com/safing/intel-data/master/lists/securedns-ip4.txt"
        type: "IPv4"
        parser: "hostsfile"
      - url: "https://raw.githubusercontent.com/safing/intel-data/master/lists/securedns-ip6.txt"
        type: "IPv6"
        parser: "hostsfile"
    website: "https://github.com/safing/intel-data"
    contribute: "https://github.com/safing/intel-data"
    license: "CC-BY-SA-4.0"

  - name: "Safing Special List: P2P Assistive Infrastructure"
    id: "17-P2P"
    description: "Services that provide STUN, TURN, ICE or similar services that expose the user's IP address and enable peer to peer networking behind NAT. Used for advanced privacy protection."
    urls:
      - url: "https://raw.githubusercontent.com/safing/intel-data/master/lists/p2p.txt"
        type: "Domain"
        parser: "domainlist"
      - url: "https://raw.githubusercontent.com/safing/intel-data/master/lists/p2p-ip4.txt"
        type: "IPv4"
        parser: "hostsfile"
      - url: "https://raw.githubusercontent.com/safing/intel-data/master/lists/p2p-ip6.txt"
        type: "IPv6"
        parser: "hostsfile"
    website: "https://github.com/safing/intel-data"
    contribute: "https://github.com/safing/intel-data"
    license: "CC-BY-SA-4.0"

  - name: "BlockYouX"
    id: "BYX"
    description: "Privacy Focused Block List by ceadd.ca."
    category: "EXPERIMENTS"
    urls:
    - url: "https://ceadd.ca/blockyoux.txt"
      type: "Domain"
      parser: "hostsfile"
    website: "https://ceadd.ca/blockyoux/"
    contribute: "https://ceadd.ca/blockyoux/"
    license: "BlockYouX is free."

  - name: "Tracker List by Daniel Cuthbert"
    id: "DCT"
    description: "List of trackers researched by Daniel Cuthbert"
    category: "EXPERIMENTS"
    urls:
    - url: "https://raw.githubusercontent.com/danielcuthbert/trackers/master/trackers.txt"
      type: "Domain"
      parser: "domainlist"
    website: "https://github.com/danielcuthbert/trackers"
    contribute: "https://github.com/danielcuthbert/trackers"
    license: "CC0-1.0"

  - name: "IPsum Threat Intelligence Feed"
    id: "IPS"
    description: "Threat intelligence feed based on 30+ different publicly available lists of suspicious and/or malicious IP addresses"
    category: "MAL"
    urls:
    - url: "https://raw.githubusercontent.com/stamparm/ipsum/master/levels/3.txt"
      type: "IPv4"
      parser: "hostsfile"
    website: "https://github.com/stamparm/ipsum"
    contribute: "https://github.com/stamparm/ipsum/issues"
    license: "Unlicense"

  - name: "AdGuardDNS List by ray"
    id: "AGD"
    description: "AdGuard DNS is a simplified filter list made for DNS-level blocking. It includes various lists from AdGuard."
    category: "BAD"
    urls:
    - url: "https://raw.githubusercontent.com/r-a-y/mobile-hosts/master/AdguardDNS.txt"
      type: "Domain"
      parser: "hostsfile"
    website: "https://github.com/r-a-y/mobile-hosts"
    contribute: "https://github.com/r-a-y/mobile-hosts/issues"
    license: "GPL-3.0"

  - name: "OISD.nl Blocklist"
    id: "OISD-BAD"
    description: "Wide collection of domains with a focus on not breaking any websites."
    category: "BAD"
    urls:
    - url: "https://dblw.oisd.nl/"
      type: "Domain"
      parser: "domainlist"
    website: "https://oisd.nl/"
    contribute: "https://oisd.nl/reportfalsepositive"
    license: "Free to use."

  - name: "OISD.nl Extra Blocklist"
    id: "OISD-EXTRA"
    description: "An addition to the main OISD.nl blocklist, with the possibility of breaking websites."
    category: "EXPERIMENTS"
    urls:
    - url: "https://dblw.oisd.nl/extra/"
      type: "Domain"
      parser: "domainlist"
    website: "https://oisd.nl/"
    contribute: "https://oisd.nl/reportfalsepositive"
    license: "Free to use."

  - name: "OISD.nl Blocklist"
    id: "OISD-NFSW"
    description: "A mixed NSFW blocklist by OISD."
    category: "NSFWM"
    urls:
    - url: "https://dblw.oisd.nl/nsfw/"
      type: "Domain"
      parser: "domainlist"
    website: "https://oisd.nl/"
    contribute: "https://oisd.nl/reportfalsepositive"
    license: "Free to use."

  - name: "CRL endpoints by Scott Helme"
    id: "SH-CRL"
    description: "List of Certificate Revocation List endpoints, collected by Scott Helme. This will block checks if a (TLS/HTTPS) certificate is valid, which experts like Scott Helme argue is pointless. Improves privacy and only maybe decreases security."
    category: "EXPERIMENTS"
    urls:
    - url: "https://raw.githubusercontent.com/ScottHelme/revocation-endpoints/master/crl.txt"
      type: "Domain"
      parser: "hostsfile"
    website: "https://github.com/ScottHelme/revocation-endpoints"
    contribute: "https://github.com/ScottHelme/revocation-endpoints/issues"
    license: "CC0-1.0"

  - name: "OCSP endpoints by Scott Helme"
    id: "SH-OCSP"
    description: "List of Certificate Status endpoints, collected by Scott Helme. This will block checks if a (TLS/HTTPS) certificate is valid, which experts like Scott Helme argue is pointless. Improves privacy and only maybe decreases security."
    category: "EXPERIMENTS"
    urls:
    - url: "https://raw.githubusercontent.com/ScottHelme/revocation-endpoints/master/ocsp.txt"
      type: "Domain"
      parser: "hostsfile"
    website: "https://github.com/ScottHelme/revocation-endpoints"
    contribute: "https://github.com/ScottHelme/revocation-endpoints/issues"
    license: "CC0-1.0"