cookbook

Known malicious domains and address ranges, merged from open threat-intelligence feeds. Built 2026-10-20 03:28:08 UTC.

Files

• list.txt: the merged list, one entry per line.
• list.txt.sha256: its SHA-256.
• stats.json: counts and the status of each source.
• attribution.txt: sources and their licenses.
• removed.txt: feed entries left out (popular sites, public suffixes, protected ranges), with the reason.
• /sources/<id>.txt: each source on its own, normalized.

Use it with SafeRoom

Put these keys in the ProviderConfiguration of the SafeRoom MDM profile:

<key>ListURL</key>
<string>https://cookbook.oldsalt.zone/list.txt</string>
<key>ListSHA256URL</key>
<string>https://cookbook.oldsalt.zone/list.txt.sha256</string>

Any blocker that reads one domain per line can use the list too. Lines that start with # are comments, and lines with a / are address ranges.

This list is for testing and for people who want a free starting point. It has no warranty. Feeds sometimes list legitimate sites that were compromised. Before you put a fleet on this list, read the sources, and set an allowlist.

Sources

fresh: downloaded this build. held: the source changed size suddenly, so its previous copy is used for up to 48 hours. fallback: the download failed, so the last published copy was used. failed: no recent copy was available.