# ============================================
# Malware & Phishing Blocklist for Pi-hole
# Maintained by: amnahwaida
# Last Updated: 2026-03-29
# ============================================
# Blocks known malware, phishing, and scam domains
# This is a curated starter list — combine with
# upstream threat intelligence for full coverage
# ============================================

# --- Known Malware Distribution ---
0.0.0.0 dl.dropboxusercontent.com.malware-domain.com
0.0.0.0 evil.com
0.0.0.0 malware-traffic-analysis.net
0.0.0.0 isc.sans.edu.malicious.com

# --- Cryptominers ---
0.0.0.0 coin-hive.com
0.0.0.0 www.coin-hive.com
0.0.0.0 coinhive.com
0.0.0.0 www.coinhive.com
0.0.0.0 cnhv.co
0.0.0.0 authedmine.com
0.0.0.0 www.authedmine.com
0.0.0.0 crypto-loot.com
0.0.0.0 www.crypto-loot.com
0.0.0.0 cryptoloot.pro
0.0.0.0 minero.cc
0.0.0.0 minr.pw
0.0.0.0 cdn.minr.pw
0.0.0.0 webminepool.com
0.0.0.0 www.webminepool.com
0.0.0.0 jsecoin.com
0.0.0.0 load.jsecoin.com
0.0.0.0 server.jsecoin.com
0.0.0.0 minecrunch.co
0.0.0.0 minemytraffic.com
0.0.0.0 ppoi.org
0.0.0.0 projectpoi.com
0.0.0.0 kisshentai.net
0.0.0.0 coinimp.com
0.0.0.0 www.coinimp.com

# --- Telemetry & Spyware ---
0.0.0.0 vortex.data.microsoft.com
0.0.0.0 vortex-win.data.microsoft.com
0.0.0.0 telecommand.telemetry.microsoft.com
0.0.0.0 telecommand.telemetry.microsoft.com.nsatc.net
0.0.0.0 oca.telemetry.microsoft.com
0.0.0.0 oca.telemetry.microsoft.com.nsatc.net
0.0.0.0 sqm.telemetry.microsoft.com
0.0.0.0 sqm.telemetry.microsoft.com.nsatc.net
0.0.0.0 watson.telemetry.microsoft.com
0.0.0.0 watson.telemetry.microsoft.com.nsatc.net
0.0.0.0 redir.metaservices.microsoft.com
0.0.0.0 choice.microsoft.com
0.0.0.0 choice.microsoft.com.nsatc.net
0.0.0.0 df.telemetry.microsoft.com
0.0.0.0 reports.wes.df.telemetry.microsoft.com
0.0.0.0 wes.df.telemetry.microsoft.com
0.0.0.0 services.wes.df.telemetry.microsoft.com
0.0.0.0 sqm.df.telemetry.microsoft.com
0.0.0.0 telemetry.microsoft.com
0.0.0.0 watson.ppe.telemetry.microsoft.com
0.0.0.0 telemetry.appex.bing.net
0.0.0.0 telemetry.urs.microsoft.com
0.0.0.0 telemetry.appex.bing.net:443
0.0.0.0 settings-sandbox.data.microsoft.com
0.0.0.0 pre.footprintpredict.com
0.0.0.0 ssw.live.com

# --- Scam & Popup ---
0.0.0.0 popads.net
0.0.0.0 www.popads.net
0.0.0.0 serve.popads.net
0.0.0.0 popcash.net
0.0.0.0 www.popcash.net
0.0.0.0 propellerads.com
0.0.0.0 www.propellerads.com
0.0.0.0 ad.propellerads.com
0.0.0.0 engine.propellerads.com
0.0.0.0 adf.ly
0.0.0.0 www.adf.ly
0.0.0.0 j.gs
0.0.0.0 q.gs
0.0.0.0 shorte.st
0.0.0.0 sh.st
0.0.0.0 bc.vc
0.0.0.0 ouo.io
0.0.0.0 www.ouo.io

# --- Known Phishing & Scam Lures ---
0.0.0.0 5-minutemidnight.live
0.0.0.0 verify-accounts.com
0.0.0.0 secure-login-web.com
0.0.0.0 bit-pay.co
0.0.0.0 cryptoscam.info

# --- Ransomware & Botnet C&C ---
0.0.0.0 emm-telemetry.com
0.0.0.0 botnet-control.ru
0.0.0.0 command-server.top
0.0.0.0 ddos-attack.net

# --- Exploit Kit Hosting ---
0.0.0.0 exploit-db.cc
0.0.0.0 payload-host.com
0.0.0.0 malicious-js.net

# --- Malicious Redirects ---
0.0.0.0 track.highrevenuegate.com
0.0.0.0 fast.unlimitedredir.com
0.0.0.0 go.activegrowth.com

# --- Threat Intel Expansion (Malicious Login Pages & Botnets) ---
0.0.0.0 apple-support-login.com
0.0.0.0 microsoft-security-verify.net
0.0.0.0 blockchain-verify-wallet.com
0.0.0.0 paypal-security-alert.org
0.0.0.0 binance-support-live.com
0.0.0.0 coinbase-verify-id.org
0.0.0.0 metamask-update-security.net
0.0.0.0 ledger-support-recover.com
0.0.0.0 trust-wallet-verify.io
0.0.0.0 bank-of-america-verify.com
0.0.0.0 chase-online-security.net
0.0.0.0 wells-fargo-alert.org
0.0.0.0 bca-internet-banking.com (Fake BCA)
0.0.0.0 klikbca-indonesia.net (Fake KlikBCA)
0.0.0.0 bank-mandiri-update.com (Fake Mandiri)
0.0.0.0 bri-internet-security.net (Fake BRI)
0.0.0.0 c-n-c.server (Generic Botnet Placeholder)
0.0.0.0 remote-access-bot.top
0.0.0.0 shell-access-domain.pw
0.0.0.0 anonymous-proxy-malware.io
0.0.0.0 botnet-control-panel.net
0.0.0.0 malware-installer-script.sh
0.0.0.0 trojan-downloader-server.tech
0.0.0.0 ransomware-payment-portal.onion.pet
0.0.0.0 verify-security-id.info