Server Infrastructure & Transparency Report

Security & Privacy Pipeline

Flow: Left → Right

01 FIREWALL

nftables

Kernel-level packet filtering. Blocks malicious IPs and rate-limits abusers before they reach our stack.

Rate Limiting

Threat-Feed IP Blocking

Default-Drop Inbound

02 FILTERING

dnsdist

Query filtering with no cache of its own. Blocks ads, trackers, malware and phishing against four public blocklists, then passes everything else to the validating resolver. Runs exactly as released, with no patches.

Adware & Tracking

Malware & Phishing

No Cache of Its Own

03 CACHE & DNSSEC

Unbound DNS

Validating resolver. Cryptographically verifies DNSSEC signatures and serves hot records from its own prefetching in-memory cache.

DNSSEC Validation

Prefetch Caching

Aggressive NSEC (RFC 8198)

04 UPSTREAM

DNS over TLS

Unbound forwards every cache miss over DNS over TLS to Cloudflare and Quad9, so nothing reaches the upstream resolvers in plaintext.

DoT (RFC 7858)

Two Upstream Operators

No Client Subnet (ECS) Sent

Active IP Blocklists (nftables kernel-level)

We block these sources at the network edge. The list below is the set of feeds currently enabled, all fetched from the FireHOL IP lists.

Enabled Threat Feeds Active

FireHOL Level 1

FireHOL's base list, built for few false positives: unrouteable address space plus several attack lists.

Essential

Spamhaus DROP + EDROP

Address ranges Spamhaus lists as hijacked or run by spam and malware operations.

Essential

BotScout + Blocklist.de

Decommissioned 7 July 2026. Disabled after its crowd-sourced reports were found to include legitimate search engine crawlers (Googlebot, Bingbot). Full incident writeup: When Your Blocklist Bans Googlebot.

Disabled (FP Mitigation)

Feodo Tracker

C2 servers for banking trojans (Dridex, Emotet, Trickbot).

Malware

CyberCrime Tracker

Command-and-control servers tracked by the CyberCrime project.

Malware

ET Compromised

Emerging Threats list of hosts known to be infected.

Malware

DShield (SANS ISC)

Top attacking subnets reported by the global sensor network.

Attacks

GreenSnow

Decommissioned 7 July 2026. Disabled as redundant with the feeds above.

Disabled (Redundant)

DNS Filter Lists (dnsdist)

Domain-based blocklists that filter ads, trackers, malware, and phishing at the DNS level. These work after traffic passes the firewall.

Counts measured 6 August 2026 - reopen the page to recalculate them live from the source lists in your browser.

261,790

rules blocked across all lists

Filter Source Live Sync

AdGuard DNS Filter

The baseline standard for blocking ads & general trackers.

163,297 rules filter_1.txt

OISD Blocklist Small

High-speed, essential blocking for maximum stability.

56,395 rules filter_5.txt

Phishing URL Blocklist

Real-time phishing & fraud domains from PhishTank and OpenPhish.

34,808 rules filter_30.txt

Malicious URL Blocklist

Active malware-distribution URLs tracked by abuse.ch URLHaus.

7,290 rules filter_11.txt

Fair Use

A per-address limit protects the service from automated abuse. It is sized for CGNAT networks, prefetching and ad-heavy pages, and ordinary use from a household or an office does not come close to it.

Configuration last verified October 19, 2026