AdGuard Home is a production-grade, self-hosted network-wide ad/tracker blocking DNS server. In operation it listens for DNS queries, applies filtering via blocklists, custom rules, parental control, safe search, and DNS rewrites, forwards remaining queries to upstream resolvers over plain DNS, DoT, DoH, or DoQ, and records query logs and statistics. It also includes a DHCP server for IPv4/IPv6, client identification through ARP/WHOIS/rDNS/DHCP/hosts files, TLS/encryption management, and a REST API documented in the openapi directory. The Go backend is a modular monolith organized into domain packages such as dnsforward, filtering, querylog, stats, dhcpd/dhcpsvc, home, and the new next/websvc, with heavy use of interfaces and OS-specific build tags for Linux, macOS, Windows, FreeBSD, and OpenBSD. The repository ships two frontends in parallel: a legacy React/Redux application under client/ and a newer SolidJS application under client_v2/, both built with webpack and backed by the same HTTP control API. Entry points include main.go for the stable product and main_next.go for an ongoing architectural rewrite. Configuration is stored in YAML and migrated through 34 schema versions using a dedicated migration framework. The codebase is extensively tested at both unit and end-to-end levels, and release packaging scripts cover many OS/arch targets. The presence of JSON tracker metadata and safe-search rule lists is operational data, not research artifacts; this is not a data pipeline or analytics repository. Primary data flows: DNS request -> dnsforward request handler -> client identity lookup -> filtering engine (urlfilter, custom rules, hosts) -> safe-search/rewrite handling -> upstream forwarding -> response; each query is written to a binary query log and aggregated into statistics. DHCP leases persist through JSON databases, and embedded datasets such as whotracksme metadata and blocked-services definitions support UI and filtering behavior. The largest current risk is the dual-frontend and dual-backend transition, which creates duplication and increases maintenance burden, but the core DNS/DHCP/filtering paths remain coherent and well-tested.
FREE Browser is an Android web application focused on privacy and user control. It implements a tabbed browsing interface using Android WebView with extensive privacy protections including ad-blocking via StevenBlack host lists, cookie banner blocking using Mozilla's rule list, and fingerprint protection through JavaScript injection that spoofs canvas, WebGL, AudioContext, and font metrics. The application features granular controls for JavaScript, DOM storage, and cookies per domain, comprehensive bookmark and history management, download handling, and backup/restore functionality for all browser data. The architecture follows Android best practices with separate modules for browser functionality, database handling, preferences, and utility functions, using patterns like MVC, adapter patterns, and singleton for tab management.
Pi-hole is a network-wide ad blocking application that operates as a DNS sinkhole. The repository contains the core shell scripts for installation, configuration, and management of the Pi-hole system. The primary entry points are the `pihole` CLI command and `gravity.sh`, which downloads and compiles blocklists into a SQLite database. The architecture is a collection of bash scripts that orchestrate the FTLDNS daemon (a separate binary) and provide a command-line interface for allow/deny lists, querying, debugging, and updates. The code is well-structured with modular functions, error handling, and extensive test coverage across multiple Linux distributions. It is a mature, actively maintained project with a large community.
This repository is a data pipeline that aggregates and consolidates hosts files from 20+ upstream sources (adaway.org, mvps.org, someonewhocares.org, yoyo.org, URLHaus, KADhosts, hostsVN, and others) into unified blocklists for adware, malware, tracking, and optional categories (porn, gambling, fake news, social media). The core pipeline (`updateHostsFile.py`) fetches remote hosts files via HTTP, parses them, deduplicates entries, applies whitelist/blacklist filters, and generates a primary `hosts` file plus 30+ alternate permutations in `alternates/`. Each source has metadata in `update.json` (URL, license, frequency). The `makeHosts.py` script orchestrates full matrix generation of all extension combinations. Output includes stats tracking (`stats.out`, `stats.png`) and auto-generated READMEs via `updateReadme.py`. The repo includes Docker support, GitHub Actions CI (lint, test, multi-Python), CodeQL scanning, and automated dependency updates via Dependabot. Data sources are external URLs; the pipeline is idempotent and designed for scheduled runs.
GKD is an open-source Android application that automates UI interactions, primarily to skip ads, auto-confirm dialogs, and perform custom click actions. It operates as an accessibility service, using a custom selector language (similar to CSS) to match UI nodes and execute actions defined in remote subscription rules. The app is built with Kotlin and Jetpack Compose, leveraging Room for local persistence, Ktor for HTTP, and Coroutines/Flow for reactive state management. It also integrates with Shizuku for privileged operations like input injection and screenshot capture. The architecture is modular: the main `gkd-app` module contains the UI, services, and rule engine; `gkd-selector` is a Kotlin Multiplatform library for parsing and matching the custom selector syntax; `gkd-db` provides a multiplatform database layer; and `gkd-hidden-api` contains stubs for Android hidden APIs used for automation. Key entry points include the accessibility service (`A11yService`), the subscription repository (`SubscriptionRepository`), and the snapshot capture system. Data flows involve downloading subscription rules, parsing them into internal representations, matching against accessibility node trees, and executing actions (click, swipe, etc.). External dependencies include AndroidX libraries, Ktor, Kotlin Serialization, Coil, and the Shizuku privilege library. The codebase demonstrates strong engineering practices with extensive unit tests, a well-defined selector engine, and reusable patterns like `Loadable` for async state and `MutexState` for concurrency. However, it relies heavily on hidden Android APIs and a custom DSL, which introduces maintenance risk. Overall, it is a high-quality, actively maintained project with significant reuse potential in its selector engine and utility components.
This repository is a curated collection of domain blocklists for various categories (ads, malware, porn, etc.) with automated build and maintenance pipelines. It ingests raw domain lists from community submissions and upstream sources, normalizes them, and outputs them in multiple formats (plain text, AdGuard, dnsmasq, etc.) suitable for use in DNS-level content filtering. The project includes a Python package for list processing (normalization, validation, merging), scripts for triaging issues, and GitHub Actions workflows for continuous integration and release management. It serves as a central resource for users of Pi-hole, AdGuard Home, and similar DNS filtering tools. The codebase is well-structured with tests and CI, though the core logic is tightly coupled to the project's configuration and domain-specific rules.
WireHole is a Docker Compose project that combines WireGuard, Pi-hole, and Unbound to create a private VPN with ad-blocking and recursive DNS resolution. It is not a software library but an infrastructure deployment template. The stack provides a VPN server, DNS filtering through Pi-hole, and private DNS resolution via Unbound, all running in containers. The project is designed for easy deployment on a Linux server, with a focus on security (e.g., web interfaces bound to localhost, minimal container capabilities, strong password generation). It supports two VPN backends: wg-easy (with a web UI) and linuxserver/wireguard (configuration-file based). The codebase consists of shell scripts for setup, migration, and diagnostics, along with CI/CD pipelines, test suites, and detailed documentation. The project demonstrates high operational maturity with comprehensive tests, pinning of image versions, and a doctor script for troubleshooting. While it is not a reusable software library, its scripts and configuration patterns are well-crafted and could serve as templates for similar Docker Compose deployments.
This repository is the data pipeline used by Mullvad VPN to produce DNS blocklists for ads, trackers, adult content, gambling, social media, and malware. It ingests multiple upstream blocklists (from oisd, hagezi, AdGuard, Firebog, etc.) and custom lists via an Ansible playbook, cleans and normalizes them (removing localhost IPs, comments, special characters), combines them by category, and outputs plain-text domain lists and RFC-compliant zone files for both encrypted DNS (DoH) and VPN relay servers. The output files are GPG-signed for integrity. A CI workflow validates zone files using named-checkzone. The repository also includes scripts for generating social media blocklists by enumerating subdomains (via subfinder) and fetching IP ranges for major social platforms (Facebook, TikTok, Snapchat) using ASN lookups. While tightly coupled to Mullvad's infrastructure, the ETL pattern and zone file generation logic are well-structured and could be adapted for similar DNS blocking pipelines.
This repository is a comprehensive collection of proxy routing rule sets and configuration files for multiple proxy clients (Surge, Loon, Quantumult X, Stash, Shadowrocket, mihomo, sing-box, Egern). It provides pre-curated domain/IP lists for services (e.g., Netflix, Telegram, OpenAI), ad-blocking (e.g., Ads_AWAvenue, EasyListChina), and China network identification (e.g., ChinaASN with 5076 entries). The rules are duplicated across platforms with format adaptations, and the repository includes full client configuration templates and server deployment examples (e.g., sing-box Hysteria2, AnyTLS). A few Surge panel scripts (Peekabo, Aliyun ECS CDT, Lightsail) demonstrate self-contained HTTP API client patterns with HMAC signing and caching. While not a software application itself, the repository is a dependency for proxy clients and includes several reusable script components.
This is a configuration-only repository for Shadowrocket, an iOS VPN/proxy application. It provides dozens of pre-built rule sets that control how network traffic is routed (direct vs. proxy) and includes ad-blocking rules compiled from multiple public sources such as GFWList, EasyList, and community-maintained domain lists. The repository does not contain any application code, libraries, or data processing pipelines; it is solely a collection of static `.conf` files. The build process that generates these configurations resides in a separate `build` branch (not included in the release branch), using Python scripts to merge and format rules daily via GitHub Actions. Users import these configuration files directly into Shadowrocket for automatic traffic splitting and ad filtering. The rules are continuously updated (daily cron) and include specialized modes like whitelist, blacklist, China-only, and lazy configurations with proxy groups for fine-grained control.
This repository provides curated rule lists for the Shadowrocket iOS proxy application, categorizing tens of thousands of domains and IP ranges into DIRECT (no proxy), PROXY (route through proxy), and REJECT (block) sets. The rules are distributed as Shadowrocket modules that can be loaded independently or combined to implement white-list or black-list routing strategies. The data is aggregated from multiple public sources including dnsmasq-china-list, v2fly domain list, gfwlist, adblock lists, and custom additions for services like TikTok, OpenAI, Telegram, and Google Gemini. The repository also includes a minimal configuration example and factory files that allow users to customize rule sets by appending or excluding specific entries before automated builds. There is no application code; the entire output is data files consumed by Shadowrocket. The repository relies on external CI (not visible in the file tree) to regenerate the modules daily.
This repository is a lightweight PHP CLI tool that converts ad-blocking filter lists (primarily from AdGuard's CNAME tracker research and EasyPrivacy) into HOSTS-format blocklists. The core script, converter.php, fetches upstream lists from hardcoded URLs, parses domain entries, and outputs files containing '0.0.0.0 <domain>' lines. The generated .txt files (e.g., AdguardMobileAds.txt, EasyPrivacy3rdParty.txt) are committed to the repository and meant to be consumed by HOSTS-file-based ad blockers on mobile devices. The architecture is intentionally minimal: a single PHP script handles conversion, a shell script (.check.sh) automates periodic updates by committing only when the diff is exactly one line, and a GitHub Actions workflow (php.yml) runs the converter on a schedule. The tool is designed for manual or scheduled regeneration, not as a live service. It relies on upstream AdGuard lists, which introduces a maintenance risk if those sources change format or disappear. The repository is a hybrid of application code and generated data artifacts, but the dominant character is a small utility application. The converter is generic enough to accept custom list names and URLs, making it reusable for other filter-list-to-hosts conversions. However, the conversion is lossy—many filter options (e.g., $domain, $third-party, $redirect) are ignored—and there are no tests or CI validation for the converter logic. The project is functional for its niche but shows signs of technical drift and brittle upstream coupling.
This repository provides an Android ad-blocking Magisk module (named '去广告' / 'Remove Advertise') that blocks ads at the system level using hosts file redirection, iptables firewall rules, file locking (chattr), and app component disabling (pm). It includes a comprehensive, community-curated blocklist in both hosts file format (all, reward) and Adblock Plus format (adb.txt), targeting Chinese mobile apps and ad networks. The repo also hosts a GitHub Pages website (index.html) for distribution, donation, and version history (over 200 releases). While primarily an application (Magisk module), it has a strong data component in the form of curated blocklists, making it a hybrid project. The module is distributed as flashable ZIP archives in the module/ directory, with an update.json for Magisk's auto-update mechanism. The codebase is functional and well-used (1014 stars) but shows signs of maintenance burden (large version list, incomplete English documentation, history-cleanup workflow that destroys git history).
This repository is a massive, curated collection of network proxy routing rules (分流规则) for multiple proxy tools including Surge, Loon, QuantumultX, Shadowrocket, Clash, Stash, and AdGuard. The rules are auto-generated by an internal 'RULE GENERATOR' from public data sources (e.g., LM-Firefly/Rules, ACL4SSR, kr328.app) and cover thousands of services—from streaming platforms and social media to banking and gaming. Each rule set is provided in multiple formats (`.list`, `.yaml`, `.sgmodule`, `.plugin`) and distributed via daily-updated master and irregular release branches with CDN mirrors. The repository also includes a smaller set of automation scripts (JavaScript) that run inside proxy clients, performing tasks such as ad removal, cookie harvesting, daily check-ins, and TestFlight beta joining. These scripts rely on a custom cross-platform framework called MagicJS, which abstracts the APIs of Surge, Loon, QuantumultX, and Node.js. While the primary character is data aggregation and transformation (rule generation), the presence of application-like automation scripts makes it a hybrid repository. The rule sets are the core deliverable and are widely used by the proxy tool community. The automation scripts are secondary but demonstrate non-trivial engineering for multi-account session management and persistent storage. The repository is actively maintained (last commit 2026-08-21, though some rule sets show stale timestamps from 2024) and has a large user base (27k stars). However, technical drift is medium due to reliance on external data sources, embedded library duplication, and lack of automated testing. Reproducibility is low because the rule generator is not publicly available, and the scripts require specific proxy tool environments and MITM setup.
This repository is a collection of domain blocklists designed for use with Pi-hole and similar DNS-based ad-blocking services. It provides multiple specialized text files containing domain names to block, categorized by purpose (e.g., ads and trackers, telemetry, specific applications like TikTok and WhatsApp, malware, ransomware, and spam). The README explains how to integrate these lists into Pi-hole's adblocking configuration. While the repository lacks visible data processing code (showing only the final curated lists), the topical organization and maintenance updates suggest an ongoing curation effort aimed at removing false positives and optimizing the lists for specific use cases.
This repository is a curated collection of proxy rule configurations for multiple proxy clients (Clash, Stash, Shadowrocket, Surge, Surfboard, QuantumultX, Egern). It provides pre-built rule sets for routing traffic for specific services (YouTube, Netflix, Disney+, Bilibili, TikTok, HoYoGames, etc.), ad blocking via MITM rewriting, DNS configuration, and various utility overrides (e.g., cron scripts for JD sign-in, Bilibili manga, Epic free games). The repository is essentially a personal configuration template set, with the actual logic and maintenance delegated to external upstream rule repositories (e.g., blackmatrix7/ios_rule_script, NobyDa, app2smile). The code (configs) is well-organized by tool and purpose, with clear Chinese comments. It demonstrates a thorough understanding of proxy tool capabilities, especially Stash's override system for advanced MITM rewriting and ad blocking. However, it is not a reusable software library or application; it is a static configuration archive. The primary value is for users of these proxy tools who want an out-of-the-box rule set with minimal customization.
This repository is a curated, versioned collection of domain names and URLs used by mobile location tracking libraries, analytics SDKs, adware, spyware, stalkerware, malware, and other telemetry-gathering software. The primary output is three text files in standardized ad-blocking formats (plain hostnames, AdBlock Plus syntax, uBlock Origin syntax) plus a separate Windows telemetry list. The data is sourced from reverse engineering Android APKs (referenced by file hash), public security research reports, passive DNS data, and investigative journalism. The repo serves both as a domain blocklist for privacy-focused users and as a reference for threat intelligence analysts. It is not a software application or an automated data pipeline; it is a manually curated dataset maintained through ongoing research and community contributions.