Skip to content

README.md

Latest commit

 

History

History
88 lines (60 loc) · 4.16 KB

README.md

File metadata and controls

88 lines (60 loc) · 4.16 KB

Proxyware Blocklist

DNS blocklist targeting proxyware — apps and SDKs that turn user devices into residential proxy nodes, often without meaningful consent.

Unlike broader proxy bypass lists (e.g., Hagezi DoH/VPN/TOR/Proxy Bypass), this list does NOT block VPNs, DoH/DoT servers, or TOR. It focuses exclusively on residential proxy and bandwidth-sharing services.

Quick Start

AdGuard Home

Settings → Filters → DNS Blocklists → Add blocklist → Add a custom list:

https://raw.githubusercontent.com/Flo5k5/proxyware-blocklist/main/proxyware.txt

Pi-hole

# Add to /etc/pihole/adlists.list (requires hosts format conversion)
# Or use pihole -a adlist add with the raw URL
pihole -a adlist add https://raw.githubusercontent.com/Flo5k5/proxyware-blocklist/main/proxyware-hosts.txt

NextDNS / ControlD

Add as a custom denylist using the raw URL above.

What's Blocked

Category Services Domains
Proxyware SDKs Bright Data SDK, Hola SDK, IPIDEA SDKs, Infatica, Massive, Covert SDKs ~40
Bandwidth sharing apps Honeygain, Pawns/IPRoyal, PacketStream, Peer2Profit, Traffmonetizer, Repocket, Earn.FM, Bitping, Salad, etc. ~50
P2P proxy VPNs Hola VPN, Urban VPN, Tuxler VPN, Mysterium, IPIDEA VPN brands ~40
Crypto bandwidth apps Grass, Nodepay, Gradient, SpeedShare, Teneo, Dawn, etc. ~25
Commercial proxy providers Oxylabs, Smartproxy, GeoSurf, NetNut, ProxyRack, Webshare, SOAX, etc. ~25

Total: 181 domains across 38+ services

What's NOT Blocked

  • Legitimate VPN services (NordVPN, ExpressVPN, Mullvad, etc.)
  • Encrypted DNS providers (Cloudflare DoH, Google DoH, etc.)
  • TOR infrastructure
  • Corporate proxy/VPN solutions

What is Proxyware?

Proxyware (also called "bandwidth sharing" or "passive income" apps) are services that route third-party internet traffic through your device. You get paid a few dollars per month; the proxy operator sells your residential IP address to customers who need to appear as real users from your location.

The problem:

  • Your IP address gets used for web scraping, ad fraud, credential stuffing, or worse
  • SDK-based proxyware gets bundled into free apps — you might not even know it's running
  • Trend Micro research classifies these as riskware
  • The IPIDEA network (disrupted by Google, Jan 2026) was used by 550+ threat groups

Sources

This blocklist aggregates proxyware domains from:

Files

File Format Use with
proxyware.txt AdGuard / uBlock (||domain^) AdGuard Home, uBlock Origin, NextDNS
proxyware-hosts.txt Hosts file (0.0.0.0 domain) Pi-hole, /etc/hosts, dnsmasq
proxyware-domains.txt Plain domains (one per line) Scripts, firewalls, custom tools

Contributing

Found a proxyware service not on the list? Open an issue with:

  1. The service name and URL
  2. Evidence it operates as proxyware (SDK integration, bandwidth sharing, etc.)
  3. Associated domains (check DNS traffic, app decompilation, etc.)

License

MIT