Skip to content
Install MCP

Threat feed

StevenBlack Hosts

Last fetched

Ad/Tracking Blocklists · refreshed daily · last verified

StevenBlack Hosts is a Ad/Tracking Blocklists threat-intelligence feed, refreshed daily, indexed by WhisperGraph.

What is StevenBlack Hosts

StevenBlack Hosts is one of the longest-running and most widely deployed unified hosts files on GitHub. It aggregates dozens of upstream community blocklists into a single hosts file (and a per-category set of variants) suitable for direct deployment via /etc/hosts, Pi-hole, or AdGuard Home. Coverage spans ad networks, malware distribution, fakenews-tagged domains, and adult content; per-category variants (ads-only, malware-only, etc.) let users opt into tighter scopes. The project receives frequent contributor PRs and is one of the most-starred host-file repositories. It is indexed here because it is the default reference file for many open-source DNS-blocking tools.

Source
https://github.com/StevenBlack/hosts
Refresh cadence
daily

Category drift. The curated category for this feed is Ad/Tracking Blocklists, while WhisperGraph currently files it under ad-tracking.

Indicators currently listed

No indicator in WhisperGraph currently links to StevenBlack Hosts. That is not the same as the feed being empty — the graph indexes a subset of every feed’s published entries.

Related pages

Pivot from StevenBlack Hosts into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.