Umbra DNS blocklists

Umbra publishes malware infrastructure hostnames and IPs from its owned abuse.ch lake (URLhaus, ThreatFox, Feodo). These are the same public CTI feeds Umbra already mirrors for collectors — not the result of scanning the public Internet.

Use them with Pi-hole, AdGuard Home, dnsmasq, or a classic hosts file.

Live feed URLs

Lists refresh from the lake on each request (short cache). Keep the abuse.ch sync timer healthy so the lake stays current.

Pi-hole

1. Open Group Management → Adlists
2. Add:

   https://umbra-osint.com/lists/malware-domains.txt
   

3. Tools → Update Gravity (or wait for the next scheduled update)

Optional: use the hosts format if your Pi-hole setup prefers hosts-style lists:

https://umbra-osint.com/lists/malware-hosts.txt

AdGuard Home

Filters → DNS blocklists → Add blocklist → Add a custom list

• Name: Umbra malware domains
• URL: https://umbra-osint.com/lists/malware-domains.txt

AdGuard / uBlock (browser)

Subscribe to:

https://umbra-osint.com/lists/malware-adblock.txt

What is (and is not) on the list

On the list

• Hostnames seen serving malware URLs (URLhaus)
• IOC hosts from ThreatFox
• Botnet C2 IPs from Feodo Tracker

Not on the list

• Advertising / tracking (use dedicated ad lists)
• Whole TLDs or “suspicious” heuristics without a feed hit
• Private / loopback / CGNAT addresses
• Results of Umbra active probing of random Internet hosts

Attribution & terms

• Upstream data: abuse.ch — respect their terms and rate limits. Umbra redistributes a filtered snapshot of what it already stores for OSINT collectors.
• Blocking is best-effort CTI. False positives happen; whitelist locally when needed. Absence from the list is not a clean bill of health.

Local / offline

If you run Umbra yourself and the API can see your lake:

curl -fsS http://localhost:8000/lists/malware-domains.txt | head

After umbra abuse sync, the list updates on the next fetch (cache ≤ ~15 minutes).