xRuffKez CTI (Cyber Threat Intelligence)

A continuously maintained blocklist of active malicious domains: phishing, malware delivery, scams, fraudulent shops and investment schemes, and the infrastructure behind them. Every entry is verified before it is published, and removed again once it is offline or no longer malicious, so the list stays current instead of growing forever.

Tip

Subscribe to one of the files below in your DNS filter, ad blocker or resolver. The lists are refreshed several times per hour; polling every 1 to 6 hours is plenty.

At a glance

_{as of 2026-10-24 09:47 UTC}

Active domains	714,736
Added in the last 24 hours	85,560
Added in the last 7 days	106,201
Added in the last 30 days	106,201
Retired in the last 30 days (offline or cleaned up)	14,831
Top-level domains represented	589
Internationalized (IDN / punycode) domains	0.1 %
Domains containing digits	20.4 %
Domains containing hyphens	16.0 %
Average domain length	18.5 characters

Activity, last 30 days

%%{init: {"themeVariables": {"xyChart": {"plotColorPalette": "#c0392b"}}}}%%
xychart-beta
    title "New domains per day, Sep 25 – Oct 24 (UTC)"
    x-axis ["25", "26", "27", "28", "29", "30", "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24"]
    y-axis "domains" 0 --> 80000
    bar [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1227, 14240, 21381, 69353]

Loading

%%{init: {"themeVariables": {"xyChart": {"plotColorPalette": "#2c7be5"}}}}%%
xychart-beta
    title "Active domains on the list, Oct 21 – Oct 24 (UTC)"
    x-axis ["21", "22", "23", "24"]
    y-axis "domains"
    line [472713, 588659, 629951, 714736]

Loading

Last 7 days as a table

Day (UTC)	Added	Retired
2026-10-24	69,353	2,398
2026-10-23	21,381	4,228
2026-10-22	14,240	7,320
2026-10-21	1,227	885
2026-10-20	0	0
2026-10-19	0	0
2026-10-18	0	0

Top-level domains

#	TLD	Domains	Share
1	.xyz	308,390	43.1 %	████████████████████
2	.com	137,193	19.2 %	█████████
3	.dev	41,037	5.7 %	███
4	.click	26,413	3.7 %	██
5	.shop	20,745	2.9 %	█
6	.sbs	17,604	2.5 %	█
7	.top	13,706	1.9 %	█
8	.org	11,942	1.7 %	█
9	.net	10,003	1.4 %	█
10	.io	8,191	1.1 %	█
11	.app	6,812	1.0 %	█
12	.cc	6,553	0.9 %	█
13	.info	5,672	0.8 %	█
14	.live	5,322	0.7 %	█
15	.vip	4,533	0.6 %	█

pie showData title Share of the 5 most common TLDs
    ".xyz" : 308390
    ".com" : 137193
    ".dev" : 41037
    ".click" : 26413
    ".shop" : 20745
    "other" : 180958

Loading

Most imitated brands

Listed domains whose name contains a well-known brand. Brand names are trademarks of their owners; the brands themselves are of course not listed.

Brand	Domains
WhatsApp	3,547	████████████████████
Meta / Facebook	2,845	████████████████
Coinbase	2,460	██████████████
Google	1,629	█████████
PayPal	1,485	████████
MetaMask	1,230	███████
Ledger	1,135	██████
Apple / iCloud	1,028	██████
Netflix	947	█████
Instagram	798	████
Microsoft / Office 365	679	████
Amazon	657	████
Binance	633	████
Telegram	399	██
American Express	364	██

Most common lure words

Word	Domains
invest	3,809	████████████████████
login	3,729	████████████████████
trade	3,065	████████████████
service	2,874	███████████████
casino	2,653	██████████████
wallet	2,592	██████████████
support	2,143	███████████
connect	2,059	███████████
secure	1,560	████████
security	1,524	████████
bet	1,469	████████
account	1,447	████████

Files

File	Format	Use it with
domains.txt	one domain per line	Technitium, Blocky, dnsmasq/Unbound scripts, firewalls, SIEM enrichment
adblock.txt	||domain^	AdGuard Home, Pi-hole v6, uBlock Origin, AdGuard, NextDNS-style filters
rpz.txt	DNS Response Policy Zone	BIND, Unbound, Knot Resolver, PowerDNS Recursor

Each entry covers the domain and all of its subdomains. On shared hosting and cloud platforms only the individual malicious hostname is listed, never the platform itself.

AdGuard Home / Pi-hole

AdGuard Home: Filters → DNS blocklists → Add blocklist → Add a custom list and enter

https://raw.githubusercontent.com/DNSBunker/CTI/main/adblock.txt

Pi-hole v6: Lists → Add a new subscribed list with the same URL (the adblock format also blocks subdomains).

uBlock Origin / AdGuard browser extension

Subscribe with one click, or add the URL under Filter lists → Import:

https://raw.githubusercontent.com/DNSBunker/CTI/main/adblock.txt

Unbound (RPZ)

rpz:
    name: cti.rpz
    url: https://raw.githubusercontent.com/DNSBunker/CTI/main/rpz.txt
    rpz-action-override: nxdomain
    rpz-log: yes
    rpz-log-name: cti

BIND 9 (RPZ)

Fetch the zone periodically, e.g. hourly from cron:

curl -fsS -o /var/named/cti.rpz.tmp https://raw.githubusercontent.com/DNSBunker/CTI/main/rpz.txt && mv /var/named/cti.rpz.tmp /var/named/cti.rpz && rndc reload cti.rpz

zone "cti.rpz" { type primary; file "/var/named/cti.rpz"; };
options { response-policy { zone "cti.rpz"; }; };

Knot Resolver / PowerDNS Recursor

Knot Resolver 5:

policy.add(policy.rpz(policy.DENY, '/etc/knot-resolver/cti.rpz', true))

PowerDNS Recursor (Lua config):

rpzFile("/etc/powerdns/cti.rpz", {defpol=Policy.NXDOMAIN})

Download the zone file as shown for BIND.

Listing policy

• Verified before listing. A domain is published only after it has been confirmed as active and malicious; suspicious-looking names alone are not enough.
• Continuously re-verified. Entries that go offline or are no longer malicious are removed automatically. The list reflects current threats, not history.
• Precise. Shared platforms (hosting, cloud, CDN, dynamic DNS) are never listed as a whole; only the individual hostname is.
• Protected services. Well-known legitimate services are on an allowlist and are never listed.

False positives

Found a legitimate domain on the list? Please open an issue with the domain and a short note why it is legitimate. Reports are reviewed with priority, and a confirmed false positive is removed from every file with the next update.

Privacy

This project does not collect, store or publish any user data, queries or network metadata.

Note

DNSBunker.org Resolvers User Data and Queries are NOT used by this CTI project by any means!

License

GNU General Public License v2.0
Copyright (C) DNSBunker.org / xRuffKez
SPDX-License-Identifier: GPL-2.0-only

---

Project: dnsbunker.org · Repository: github.com/DNSBunker/CTI