{
  "version": "2026.07.06.01",
  "last_updated": "2026-07-06T10:16:00Z",
  "author": "AdBlock Network Security Operations Center",
  "license": "Proprietary - SaaS Dynamic Filters",
  "statistics": {
    "total_rules": 47209,
    "categories": {
      "doh_resolvers": 240,
      "vpn_bypass_nodes": 1280,
      "dynamic_dns": 8450,
      "threat_intelligence_feed": 21540,
      "ad_trackers": 15699
    }
  },
  "filters": {
    "doh_resolvers": [
      { "domain": "dns.google", "ip": ["8.8.8.8", "8.8.4.4", "2001:4860:4860::8888"] },
      { "domain": "cloudflare-dns.com", "ip": ["1.1.1.1", "1.0.0.1", "2606:4700:4700::1111"] },
      { "domain": "dns.quad9.net", "ip": ["9.9.9.9", "149.112.112.112"] },
      { "domain": "doh.cleanbrowsing.org", "ip": ["185.228.168.168", "185.228.169.168"] },
      { "domain": "doh.adguard-dns.com", "ip": ["94.140.14.14", "94.140.15.15"] },
      { "domain": "dns.nextdns.io", "ip": [] },
      { "domain": "doh.mullvad.net", "ip": [] },
      { "domain": "doh.opendns.com", "ip": ["208.67.222.222", "208.67.220.220"] }
    ],
    "vpn_bypass_nodes": [
      { "domain": "bypass-doh.com", "severity": "high" },
      { "domain": "tunnel-vpn-relay.net", "severity": "critical" },
      { "domain": "anti-adblock-proxy.io", "severity": "critical" },
      { "domain": "stealth-dns-proxy.xyz", "severity": "high" },
      { "domain": "doh-tunnel-agent.info", "severity": "medium" }
    ],
    "dynamic_dns": [
      { "domain": "*.duckdns.org", "reason": "Phishing & Temp C2 Campaigns" },
      { "domain": "*.ddns.net", "reason": "Remote Access Trojan hostnames" },
      { "domain": "*.no-ip.org", "reason": "Dynamic DNS malware hosting" },
      { "domain": "*.hopto.org", "reason": "Suspicious subdomains" },
      { "domain": "*.zapto.org", "reason": "Malware delivery payloads" }
    ],
    "threat_intelligence_feed": [
      { "domain": "account-verify-login-security.net", "type": "phishing", "target": "Microsoft / Office 365" },
      { "domain": "update-agent-win11-patch.info", "type": "malware_distribution", "target": "Windows Users" },
      { "domain": "coinhive-miner-script.xyz", "type": "cryptojacking", "target": "Web browsers" },
      { "domain": "pay-invoice-confirm-pdf.com", "type": "phishing", "target": "Financial services" },
      { "domain": "steal-session-chrome-token.org", "type": "credential_stealer", "target": "Chromium extensions" }
    ],
    "ad_trackers": [
      { "domain": "telemetry.browser-metrics.com", "action": "block_cosmetic" },
      { "domain": "analytics-tracker-global.net", "action": "block_cosmetic" },
      { "domain": "adserver-bid-exchange.com", "action": "block_network" },
      { "domain": "pixel-tracking-social.info", "action": "block_network" },
      { "domain": "newspaper-adblock-detector.net", "action": "inject_scriptlet", "scriptlet": "abort-on-property-read.js" }
    ]
  }
}