DNS blocklist targeting proxyware — apps and SDKs that turn user devices into residential proxy nodes, often without meaningful consent.
Unlike broader proxy bypass lists (e.g., Hagezi DoH/VPN/TOR/Proxy Bypass), this list does NOT block VPNs, DoH/DoT servers, or TOR. It focuses exclusively on residential proxy and bandwidth-sharing services.
Settings → Filters → DNS Blocklists → Add blocklist → Add a custom list:
https://raw.githubusercontent.com/Flo5k5/proxyware-blocklist/main/proxyware.txt
# Add to /etc/pihole/adlists.list (requires hosts format conversion)
# Or use pihole -a adlist add with the raw URL
pihole -a adlist add https://raw.githubusercontent.com/Flo5k5/proxyware-blocklist/main/proxyware-hosts.txtAdd as a custom denylist using the raw URL above.
| Category | Services | Domains |
|---|---|---|
| Proxyware SDKs | Bright Data SDK, Hola SDK, IPIDEA SDKs, Infatica, Massive, Covert SDKs | ~40 |
| Bandwidth sharing apps | Honeygain, Pawns/IPRoyal, PacketStream, Peer2Profit, Traffmonetizer, Repocket, Earn.FM, Bitping, Salad, etc. | ~50 |
| P2P proxy VPNs | Hola VPN, Urban VPN, Tuxler VPN, Mysterium, IPIDEA VPN brands | ~40 |
| Crypto bandwidth apps | Grass, Nodepay, Gradient, SpeedShare, Teneo, Dawn, etc. | ~25 |
| Commercial proxy providers | Oxylabs, Smartproxy, GeoSurf, NetNut, ProxyRack, Webshare, SOAX, etc. | ~25 |
Total: 181 domains across 38+ services
- Legitimate VPN services (NordVPN, ExpressVPN, Mullvad, etc.)
- Encrypted DNS providers (Cloudflare DoH, Google DoH, etc.)
- TOR infrastructure
- Corporate proxy/VPN solutions
Proxyware (also called "bandwidth sharing" or "passive income" apps) are services that route third-party internet traffic through your device. You get paid a few dollars per month; the proxy operator sells your residential IP address to customers who need to appear as real users from your location.
The problem:
- Your IP address gets used for web scraping, ad fraud, credential stuffing, or worse
- SDK-based proxyware gets bundled into free apps — you might not even know it's running
- Trend Micro research classifies these as riskware
- The IPIDEA network (disrupted by Google, Jan 2026) was used by 550+ threat groups
This blocklist aggregates proxyware domains from:
- Hagezi DNS Blocklists — doh-vpn-proxy-bypass, pro, and TIF lists
- money4band — Multi-proxyware Docker manager (domain extraction)
- CashFactory — Multi-proxyware Docker compose
- Trend Micro: Proxyware Risk Analysis
- Cisco Talos: Proxyware Abuse
- Google: IPIDEA Disruption
- AdGuard SDNSFilter #1580
| File | Format | Use with |
|---|---|---|
proxyware.txt |
AdGuard / uBlock (||domain^) |
AdGuard Home, uBlock Origin, NextDNS |
proxyware-hosts.txt |
Hosts file (0.0.0.0 domain) |
Pi-hole, /etc/hosts, dnsmasq |
proxyware-domains.txt |
Plain domains (one per line) | Scripts, firewalls, custom tools |
Found a proxyware service not on the list? Open an issue with:
- The service name and URL
- Evidence it operates as proxyware (SDK integration, bandwidth sharing, etc.)
- Associated domains (check DNS traffic, app decompilation, etc.)
MIT