Pi-hole malware blocklist as an authenticated adlist

Pi-hole blocks names, not addresses, so only the domain lists apply. Load one critical list, in plain or adblock syntax, and add the category lists if you want them.

Entries rounded from the build of 2026-10-01; each list is rebuilt every 12 hours. Today’s counts are public and need no key.

# IsMalicious.com Blocklist - Domains (Critical)
# Format: Plain
# Generated: <BUILD_TIME>
# Total entries: <COUNT>
# Update frequency: every 12 hours
# Category: All
# Threat level: Critical
# Website: https://ismalicious.com
# © <YEAR> IsMalicious (compilation). Licensed to the downloading account under https://ismalicious.com/terms; redistribution of the compilation prohibited. Third-party entries remain under their providers' licences — see https://ismalicious.com/sources.
#

• Pi-hole Core v5.2.3 or later: earlier releases reject an @ in a list address. Pi-hole v6 is the current line.
• A shell on the Pi-hole host, or on the Docker host, to schedule gravity.
• An isMalicious API key and secret, from Account › API access.
• Outbound HTTPS (TCP 443) over IPv4 from Pi-hole to api.ismalicious.com, which has no IPv6 address.

1. 1

   Copy your API key and secret

   Open Account › API access and copy the API Key and the API Secret. The full list needs a Basic, Pro, or Enterprise plan; a Free key loads the 10% sample.
2. 2

   Build the list address

   Put the key, a colon and the secret before the host, followed by @. Keys and secrets are UUIDs, so they need no encoding. Use api.ismalicious.com: the ismalicious.com edge refuses some sources with a 403.

   https://<API_KEY>:<API_SECRET>@api.ismalicious.com/blocklist/download/blocklist-domains-critical.txt

   https://<API_KEY>:<API_SECRET>@api.ismalicious.com/blocklist/download/blocklist-domains-critical-adguard.txt

3. 3

   Add the list to Pi-hole

   Pi-hole v6: Group Management › Lists, paste the address in Address, enter a Comment such as isMalicious critical, keep the Default group and click Add blocklist. Pi-hole v5: Group Management › Adlists, then Address, Comment and Add. On v6 the API does the same: the block below verifies FTL’s own certificate, reads the password from the terminal and the address from a file, so neither lands in a process listing or the shell history, and closes the session at the end.

   # FTL's own CA, copied from /etc/pihole/tls_ca.crt on the Pi-hole host. Add
   # --resolve pi.hole:443:<PIHOLE_IP> when pi.hole does not resolve.
   CA=./pihole-tls_ca.crt
   API=https://pi.hole/api
   
   # The password is read from the terminal: it stays out of ps and history.
   # jq escapes the quotes and backslashes it may hold.
   printf 'Pi-hole password: ' >&2; stty -echo; IFS= read -r PW; stty echo; echo >&2
   SID=$(printf '%s' "$PW" | jq -Rs '{password: .}' |
     curl -sS --cacert "$CA" -X POST "$API/auth" --data @- | jq -r .session.sid)
   
   # list.json (mode 600), written with an editor, holds the address with the key:
   # {"address":"https://<API_KEY>:<API_SECRET>@api.ismalicious.com/blocklist/download/blocklist-domains-critical.txt","comment":"isMalicious critical","groups":[0]}
   curl -sS --cacert "$CA" -X POST "$API/lists?type=block" -H "X-FTL-SID: $SID" \
     -H "Content-Type: application/json" --data @list.json
   
   curl -sS --cacert "$CA" -X POST "$API/action/gravity" -H "X-FTL-SID: $SID"
   curl -sS --cacert "$CA" -X DELETE "$API/auth" -H "X-FTL-SID: $SID"

4. 4

   Run gravity

   Tools › Update Gravity › Update, or sudo pihole -g on the host. Gravity downloads the list and writes it to gravity.db.
5. 5

   Run gravity every 12 hours

   Pi-hole updates its lists once a week, at a random minute in the night. Create a cron file of your own with the updateGravity line of /etc/cron.d/pihole and a 12-hour schedule outside hours 3 and 4, where the weekly run falls: gravity has no lock. Do not edit /etc/cron.d/pihole: updates overwrite it. The line runs as pihole on v6 and as root on v5. On Docker, schedule pihole -g through docker exec on the host.

   # Pi-hole v6 (user pihole; on v5, write root). The lists are rebuilt every 12 hours.
   17 5,17 * * *   pihole    PATH="$PATH:/usr/sbin:/usr/local/bin/" pihole updateGravity >/var/log/pihole/pihole_updateGravity.log || cat /var/log/pihole/pihole_updateGravity.log

6. 6

   Keep the key out of Pi-hole (optional)

   • Pi-hole stores the address in clear in gravity.db, shows it on the Lists page and prints it in every gravity log.
   • To avoid that, create the root-only netrc file below, fetch the list with the script, which refuses an error, a body that is not a list, the 10% sample and a file whose entry count differs from its header, and add file:///var/lib/ismalicious/blocklist-domains-critical.txt as the address.
   • The script makes the copy readable for gravity.
   • On Docker, mount /var/lib/ismalicious into the container read-only and keep the same file:// address.

   install -d -m 700 /etc/ismalicious
   [ -e /etc/ismalicious/netrc ] || install -m 600 /dev/null /etc/ismalicious/netrc
   chmod 600 /etc/ismalicious/netrc
   # Then write the three lines below into it with an editor, unless it holds them already.

   machine api.ismalicious.com
   login <API_KEY>
   password <API_SECRET>

   #!/bin/sh
   # Runs as root, before gravity. /etc/ismalicious/netrc (mode 600) holds the key.
   # The copy is made readable for gravity, which reads it as pihole (Core
   # v6.4.2+) or as root; on Docker there is no pihole user on the host.
   set -eu
   NETRC=/etc/ismalicious/netrc
   DIR=/var/lib/ismalicious
   FILE=blocklist-domains-critical.txt
   
   # fetch_list LIST OUT: download one list to OUT and check it.
   # On any failure OUT is removed and the function returns 1.
   fetch_list() {
     if ! code=$(curl --silent --show-error --fail --netrc-file "$NETRC" \
         --proto '=https' --max-time 300 --retry 2 \
         --output "$2" --write-out '%{http_code}' "https://api.ismalicious.com/blocklist/download/$1"); then
       rm -f "$2"; echo "$1: download failed" >&2; return 1
     fi
     if [ "$code" != 200 ]; then
       rm -f "$2"; echo "$1: HTTP $code" >&2; return 1
     fi
     if ! head -n 1 "$2" | grep -q '^[#!] IsMalicious.com Blocklist'; then
       rm -f "$2"; echo "$1: not an isMalicious list" >&2; return 1
     fi
     if grep -q 'Lite Version' "$2"; then
       rm -f "$2"; echo "$1: lite list received, check the API key and the plan" >&2
       return 1
     fi
     # Every entry ends with a newline, and one header counts them: refuse a
     # cut, doubled or empty file.
     if [ -n "$(tail -c 1 "$2")" ]; then
       rm -f "$2"; echo "$1: cut short, no final newline" >&2; return 1
     fi
     if [ "$(grep -c '^[#!] Total entries:' "$2")" != 1 ]; then
       rm -f "$2"; echo "$1: not one Total entries line" >&2; return 1
     fi
     total=$(sed -n 's/^[#!] Total entries: \([0-9,]*\)$/\1/p' "$2" | tr -d ,)
     got=$(grep -c '^[^#!]' "$2" || true)
     if [ -z "$total" ] || [ "$total" = 0 ] || [ "$got" != "$total" ]; then
       rm -f "$2"; echo "$1: $got entries, the header says ${total:-none}" >&2
       return 1
     fi
   }
   
   mkdir -p "$DIR"
   tmp=$(mktemp "$DIR/.$FILE.XXXXXX")
   trap 'rm -f "$tmp"' EXIT
   fetch_list "$FILE" "$tmp"
   chmod 644 "$tmp"
   mv -f "$tmp" "$DIR/$FILE"
   
   # Schedule it before gravity, in /etc/cron.d/ismalicious-gravity:
   # 7 5,17 * * *   root   /usr/local/sbin/ismalicious-fetch.sh
   # List address in Pi-hole: file:///var/lib/ismalicious/blocklist-domains-critical.txt

• Gravity prints Status: Retrieval successful for the list, then Parsed N exact domains and M ABP-style domains (from Core v5.17; older releases print Imported N domains).
• N for a plain list, or M for the adblock one, matches the list’s count in /blocklist/stats, give or take one rebuild. About a tenth of it is the 10% sample.
• Group Management › Lists shows the list as downloaded or unchanged, not as failed.
• On Core v6.1 or later, the first lines of the cached copy in /etc/pihole/listsCache/ (mode 0640: read it with sudo) show # Total entries: with no Lite Version mention. A file:// list is cached as list.N.local.domains.
• pihole -q on a domain from the list names the lists that contain it.

# Gravity's summary for the list (Core v5.17+ prints Parsed, older Imported):
sudo pihole -g | grep -E 'Retrieval|Parsed|Imported'

# Core v6.1+ keeps the raw file (mode 0640): a full list has no "Lite Version".
sudo head -12 /etc/pihole/listsCache/list.*.api.ismalicious.com.domains

# The same check without Pi-hole, with the netrc file of the local copy:
sudo curl -sS --netrc-file /etc/ismalicious/netrc -D - -o /dev/null \
  "https://api.ismalicious.com/blocklist/download/blocklist-domains-critical.txt" | grep -i '^x-blocklist-version'

• Pi-hole keeps the address, credentials included, in gravity.db (left mode 664) and up to 10 backups of it under /etc/pihole/gravity_backups/, on the Lists page, in pihole -q output and in every gravity log. The file:// relay of the last step avoids that: rotate the key after switching to it.
• A plain list blocks the listed names only. The adblock variant also blocks every subdomain, which reaches more names than the list holds.
• Pi-hole cannot block IP addresses: from Core v6.1 it skips IP lines silently, and before it imported them as names nothing matches, so an IP list blocks nothing. Load blocklist-ips-* lists on a firewall.
• No RPZ, no CIDR and no wildcard entries such as *.example are served; Pi-hole needs none of them.
• The 10% sample is the first tenth of an unsorted file, not the riskiest tenth.
• Without your own cron file, Pi-hole runs gravity once a week and can be up to 7 days behind the lists.

• AG

  AdGuard Home blocklist

  Threat domains as an authenticated DNS blocklist

• IP & domain blocklist

  Every list, level and category

• STIX/TAXII threat intelligence feeds

  TAXII 2.1 collections for SIEMs and TIPs

• Threat intelligence API documentation

  Authentication, endpoints and limits

• Domain reputation check

  Check one domain before you block it