8,052 new domains entered major ad and tracking blocklists this period, while 7,518 were removed. Steven Black Unified Hosts saw the most churn, with 4,214 additions and a remarkable 5,362 removals. AdGuard DNS Filter, Base Filter, and EasyList all posted over 1,200 new entries and trimmed more than 680 each.

11nux.com and Friends: Trigger-Happy Blocking, Quick Reversals

11nux.com was added to both AdGuard DNS Filter and AdGuard Tracking Protection Filter on September 3. By September 4, it was gone from both. The same fate hit 200summit.com, 204st.us, and 360tag.com. All were added and then removed within 24 hours.

For developers and MarTech teams, this means blocklist maintainers are acting fast on reports, but sometimes too fast. If your infrastructure triggers a false positive, expect a short window of disruption—maybe only a day—before correction. Still, this can cause temporary tracking gaps or ad delivery failures, so monitor blocklist entries closely, especially after a new deploy or DNS change.

Bot Network Churn: Generated Domains Come and Go

We saw several disposable domains like 28breh9l7zjuqeeiyp8.rest, 3cpk9ptqbugrxl9ohyyzn.rest, 4ihwwi92j9l3cc.rest, and 57988tz4ky67ekx1rczfr.rest added to three lists (AdGuard Base, DNS, and EasyList) on September 1, then removed by September 4.

For anyone tracking ad fraud or malvertising, this is a reminder: most junk domains are short-lived. Blocklists catch them, but they vanish as fast as they appear. If you see a spike in broken ad calls or analytics anomalies tied to these patterns, blame churn in the botnet playbook—not list maintainers.

pubbug.com: High-Consensus Block, Real-World Risk

pubbug.com hit four lists this round: AdGuard DNS Filter, AdGuard Tracking Protection Filter, EasyPrivacy, and Peter Lowe's. When a domain appears on both ad and tracking lists, it usually means cross-network tracking or aggressive user profiling.

If you’re using third-party scripts, check your dependencies. Anything resolving to pubbug.com is now broadly blocked, so expect missing data in your analytics or failing ad requests. This is a good time to audit your vendor list for any surprises.

Legitimate-Looking Domains: a.pemsrv.com Makes the List

a.pemsrv.com was added to Peter Lowe's Ad and Tracking Server List. The "srv" suffix hints at infrastructure use, not a fly-by-night ad scam. If your service, SDK, or analytics provider relies on this endpoint, expect breakage. Developers should trace any failures in related scripts or tag managers; this block will affect a broad user base, including privacy-focused browsers and DNS services.

Numbers This Period

Next digest drops September 7, 2026. For live domain lookups, hit isblocked.fyi.