# Fortress DNS Blocklist
# Format: domain|reason|type
# type: sinkhole (optional, redirects to 0.0.0.0)
#
# LAST UPDATED: 2026-06-09
# TOTAL: 100+ entries
# ====================

# === C2 SERVERS ===
emotet-c2.example.com|Emotet C2
trickbot-panel.example.net|TrickBot Panel
cobaltstrike-beacon.example.org|CobaltStrike Beacon
dridex-cc.example.com|Dridex C2
qakbot-controller.example.net|QakBot Controller
icedid-panel.example.org|IcedID Panel
bumblebee-c2.example.com|BumbleBee C2
remcos-panel.example.net|Remcos RAT
asyncrat-c2.example.org|AsyncRAT C2
njrat-server.example.com|NjRAT
darkcomet-panel.example.net|DarkComet C2
nanocore-server.example.org|NanoCore Panel
agenttesla-panel.example.com|AgentTesla C2
formbook-c2.example.net|FormBook C2
redline-stealer.example.org|RedLine Stealer
vidar-c2.example.com|Vidar C2
azorult-panel.example.net|Azorult Panel
hawkeye-c2.example.org|HawkEye Keylogger C2
xworm-control.example.com|XWorm C2
lokibot-panel.example.net|LokiBot C2
systembc-c2.example.org|SystemBC Proxy
warzone-rat.example.com|WarZone RAT
netwire-panel.example.net|NetWire RAT
darkrat.example.org|DarkRAT C2
quasarrat.example.com|QuasarRAT C2
hancitor.example.net|Hancitor C2
ursnif-panel.example.org|Ursnif C2
gozi-c2.example.com|Gozi C2
nanolet-panel.example.net|Nanolet C2

# === RANSOMWARE C2 ===
wannacry-kill.example.com|WannaCry Kill Switch
lockbit-negotiation.example.org|LockBit Negotiation
revil-payment.example.com|REvil Payment Panel
blackcat-panel.example.net|BlackCat/ALPHV
darkside-panel.example.org|DarkSide Panel
conti-negotiation.example.com|Conti Negotiation
hive-leak.example.net|Hive Leak Site
ryuk-c2.example.org|Ryuk C2
maze-panel.example.com|Maze Panel
clop-negotiation.example.net|Clop Negotiation
ragnar-panel.example.org|Ragnar Locker
babuk-leak.example.com|Babuk Leak
gandcrab-panel.example.net|GandCrab Panel
cryptowall-c2.example.org|CryptoWall C2
cryptolocker-c2.example.com|CryptoLocker C2
petrwrap-c2.example.net|NotPetya C2
badrabbit-c2.example.org|BadRabbit C2
samSam-c2.example.com|SamSam C2
dharma-c2.example.net|Dharma/Crysis C2
phobos-panel.example.org|Phobos Ransomware

# === BOTNETS ===
mirai-c2.example.com|Mirai Botnet C2
qbot-c2.example.net|QBot
smokeloader-c2.example.org|SmokeLoader C2
zeus-panel.example.com|Zeus/Zbot
conficker-c2.example.net|Conficker C2
storm-botnet.example.org|Storm Botnet
sality-c2.example.com|Sality C2

# === CRYPTOMINERS (SINKHOLE) ===
coinhive.com|Coinhive Cryptominer|sinkhole
cryptoloot.com|CryptoLoot Miner|sinkhole
coinnebula.com|CoinNebula Miner|sinkhole
minr.pw|Minr Cryptominer|sinkhole
webmine.cz|WebMine Pool|sinkhole
coin-hive.com|CoinHive|sinkhole
jsecoin.com|JSEcoin|sinkhole
minero.cc|Minero|sinkhole
crypto-webminer.com|Crypto WebMiner|sinkhole
afminer.com|AFMiner|sinkhole

# === PHISHING ===
secure-bank-login.example.com|Fake Bank Login
apple-id-verify.example.net|Phishing Apple ID
google-docs-verify.example.org|Phishing Google Docs
microsoft-365-login.example.com|Phishing Microsoft 365
paypal-verify.example.net|Phishing PayPal
amazon-security.example.org|Phishing Amazon
netflix-account.example.com|Phishing Netflix
instagram-verify.example.net|Phishing Instagram
facebook-security.example.org|Phishing Facebook
steam-community-verify.example.com|Phishing Steam
telegram-login.example.net|Phishing Telegram
whatsapp-verify.example.org|Phishing WhatsApp
dropbox-login.example.com|Phishing Dropbox
adobe-verify.example.net|Phishing Adobe
linkedin-security.example.org|Phishing LinkedIn
twitter-verify.example.com|Phishing Twitter/X
github-login.example.net|Phishing GitHub
stackoverflow-login.example.org|Phishing Stack Overflow

# === MALWARE DISTRIBUTION ===
malware-drop.example.com|Malware Payload Host
exploit-kit.example.net|Exploit Kit Landing
payload-host.example.org|Malware Payload
drive-by.example.com|Drive-by Download
malvertising.example.net|Malvertising CDN
ransomware-payload.example.org|Ransomware Payload
trojan-dist.example.com|Trojan Distribution
worm-propagation.example.net|Worm Propagation
rootkit-download.example.org|RootKit Download
spyware-cdn.example.com|Spyware Distribution

# === TRACKING & TELEMETRY ===
doubleclick.net|Google DoubleClick|sinkhole
scorecardresearch.com|Comscore Tracking
outbrain.com|OutBrain Tracking
taboola.com|Taboola Tracking
addthis.com|AddThis Tracking
exelator.com|Exelator Telemetry
demdex.net|Adobe Demdex

# === KNOWN BAD TLD ABUSE ===
malware-dist.xyz|Abusive .xyz Domain
phishing-page.top|Abusive .top Domain
ransomware-pay.work|Abusive .work Domain
malware-download.click|Abusive .click Domain
phishing.tk|Abusive .tk Domain
payload-delivery.ml|Abusive .ml Domain
c2-server.ga|Abusive .ga Domain
malware-host.cf|Abusive .cf Domain
exploit-kit.gq|Abusive .gq Domain
darknet-market.shop|Abusive .shop Domain

# === DNS TUNNELING ===
dns-tunnel.example.com|DNS Tunneling Detected
tunnel.example.net|DNS Tunneling

# === SUSPICIOUS IP RANGES (as domains) ===
unknown-host.0x7f000001|Loopback External
reserved.host.10-0-0-1|RFC1918 External

# === DRUG & ILLEGAL ===
silkroad-market.example.com|Darknet Market
hydra-market.example.net|Hydra Market
