Release 20261012T180322Z · built 2026-10-12 18:03 UTC · valid until 2026-10-15 18:03 UTC
Every day we read the latest public reports from the research teams we follow, pull out what they flag as malicious, check it, and publish lists you can load into your DNS filter, firewall or Defender. New lists are ready every morning by 10:00 AM US Eastern. Every list expires 72 hours after it is built, so whatever you set up should refresh itself daily.
Block these.
Reported as malicious by two or more independent research teams, and passed every safety check and validation step. This is our strongest recommendation: if you have not blocked these yet, start here. Check your own traffic first all the same.
Most likely safe to block.
Validated, and reported as malicious by at least one credible research team. Includes everything on Confident. Run it in alert or log-only mode for a week or two, look at every hit, then switch to block.
Look, don't block.
Linked to suspicious activity but not proven enough to block: a single mention, an older report, shared infrastructure, or something still waiting for validation. Search your logs for these and investigate any hit. Do not block them.
Counted by when a research team first published the indicator, across all three lists.
Added and removed, release by release. History covers 6 releases back to 2026-10-09 17:15 UTC. We keep about a month of releases. Past releases are in the archive.
Pick the format for your tool. Links always point at the latest release.
One entry per line, with # comment lines at the top. The original data, for scripts and any tool that reads a plain list.
| For | Confident | Blocking | Hunting |
|---|---|---|---|
| Domains: block each with its subdomains | domains.txt 13 | domains.txt 842 | domains.txt 2,374 |
| Exact host names: never widen to the parent | hosts.txt 0 | hosts.txt 372 | hosts.txt 1,202 |
| IP addresses | ips.txt 0 | ips.txt 633 | ips.txt 1,693 |
| URLs | urls.txt 1 | urls.txt 191 | urls.txt 946 |
| File hashes, all types | hashes.txt 32 | hashes.txt 2,140 | hashes.txt 3,166 |
Protect every device on your network with no software on them.
| For | Confident | Blocking | Hunting |
|---|---|---|---|
| Pi-hole (FTL v5.22 or later), AdGuard Home | abp.txt | abp.txt | — |
| dnsmasq | dnsmasq.conf | dnsmasq.conf | — |
| Unbound, OPNsense | unbound.conf | unbound.conf | — |
| BIND, PowerDNS Recursor, Knot (RPZ) | rpz.zone | rpz.zone | — |
| One computer's hosts file (last resort) | etc-hosts.txt | etc-hosts.txt | — |
Feeds your firewall can download on a schedule.
| For | Confident | Blocking | Hunting |
|---|---|---|---|
| FortiGate domain threat feed | fortigate-domains.txt | fortigate-domains.txt | — |
| Palo Alto domain list (EDL) | paloalto-domains.txt | paloalto-domains.txt | — |
| Palo Alto URL list (EDL) | paloalto-urls.txt | paloalto-urls.txt | — |
| IP list: FortiGate, Palo Alto, pfBlockerNG | plain-ips.txt | plain-ips.txt | — |
| IPv4 only | plain-ipv4.txt | plain-ipv4.txt | — |
| IPv6 only | plain-ipv6.txt | plain-ipv6.txt | — |
| URLs, plain | plain-urls.txt | plain-urls.txt | — |
Import under Settings > Endpoints > Indicators. Defender takes up to 500 indicators per file, so there may be several. Confident files use Block; Blocking files use Audit.
| For | Confident | Blocking | Hunting |
|---|---|---|---|
| Defender import file 1 | defender-1.csv | defender-1.csv | — |
| Defender import file 2 | — | defender-2.csv | — |
| Defender import file 3 | — | defender-3.csv | — |
| Defender import file 4 | — | defender-4.csv | — |
| Defender import file 5 | — | defender-5.csv | — |
| Defender import file 6 | — | defender-6.csv | — |
| Defender import file 7 | — | defender-7.csv | — |
Single-type hash lists, and just what changed since the last release.
| For | Confident | Blocking | Hunting |
|---|---|---|---|
| MD5 hashes | hashes-md5.txt | hashes-md5.txt | — |
| SHA-1 hashes | hashes-sha1.txt | hashes-sha1.txt | — |
| SHA-256 hashes | hashes-sha256.txt | hashes-sha256.txt | — |
| Added since the last release | added.txt | added.txt | — |
| Removed since the last release | removed.txt | removed.txt | — |
For Splunk, Microsoft Sentinel, Elastic, MISP, OpenCTI and scripts.
| File | What it is |
|---|---|
| stix-bundle.json | STIX 2.1 bundle: MISP, OpenCTI, Sentinel. Ids are stable between releases. |
| lookup.csv | Lookup table: Splunk lookup, Sentinel watchlist, Elastic enrich. Blocking and hunting. |
| report.md | The full daily report (Markdown). |
| evidence.json.gz | Every blocking and hunting indicator with its role, dates and links to the reports it came from. No article text. |
| changes.json | What entered or left the blocking list in this release, and why. |
| manifest.json | SHA-256 checksums for the files above. Verify before you load anything. |
| CURRENT | The id of the latest release, for scripts. |
We publish facts and links, never the text of the source articles: follow the links in the Sources columns to read the reports.
These addresses never change, so a firewall, DNS filter or script can fetch them on a schedule. The lists update once a day, ready by 10:00 AM US Eastern, so fetch once or twice a day, for example at 10:30 AM Eastern.
https://watchmanhq.com/feed/confident/export/abp.txt
https://watchmanhq.com/feed/blocking/export/fortigate-domains.txt
https://watchmanhq.com/feed/blocking/export/plain-ips.txt
https://watchmanhq.com/feed/stix-bundle.json
https://watchmanhq.com/feed/CURRENTScripts can read /feed/CURRENT for the release id, fetch files from
/feed/releases/<id>/, and check each one against that release's
manifest.json. Step-by-step setup for Pi-hole, AdGuard Home, Unbound, FortiGate,
Palo Alto, pfSense and Defender is in How to block.
This feed is fully automated. A collector reads each source's public RSS feed, keeps only indicators the authors marked as indicators, works out what role each one played, counts how many independent teams reported it, and checks it against passive public records (domain registration, archive history, known-good file lists). Anything that fails a safety check, such as a popular site, a shared cloud address or a known legitimate file, stays off the block lists. A release gate refuses to publish if anything looks wrong, and you keep the previous release. The full detail is in Methodology, and how the whole system is built, secured and monitored is in How it's built.