This period saw 25,577 new domains added and 43,033 removed across major ad and tracking blocklists. Steven Black, AdGuard, and EasyList led the removals. EasyList alone dropped over 7,700 entries. Most new additions were the usual churn of random .cfd and .rest domains, but a handful of domains and patterns stood out.
Mass Removals: A Swift U-Turn on .cfd and .rest
A wave of garbage-looking domains—like 1ct7welkmwv95wri4eeny.rest, 1n549unzn1c8etzgjeoe.cfd, and 1fh2eyefthjqvizll1g4.cfd—were dropped from AdGuard Base, AdGuard DNS, and EasyList just two days after being added. These domains are textbook malvertising fodder: random strings, disposable TLDs, no real traffic. Someone over-eagerly blacklisted them, only to walk it back immediately.
So what? If you run analytics or ad infrastructure, expect batch removals like this to create noise in your monitoring. Sudden spikes in block rates, then sharp drops, mean it's just the lists cleaning house—likely after realizing these domains never delivered real ads or tracking.
“Rogue Philosopher” and Friends: Four-List Consensus Blocks
Some domains got the opposite treatment. roguephilosopher.com and thebicyclehut.com landed on all the top tracking lists: AdGuard DNS Filter, AdGuard Tracking Protection, EasyPrivacy, and Peter Lowe’s. That’s rare. When four maintainers agree, it usually means confirmed abuse.
No obvious adtech or analytics connection is visible from the domain names. If you see traffic to or from these, it’s time to review your vendor list or check for compromised scripts.
Why it matters: Anything blocked by four lists is going to be invisible to most users with even basic protection. If your pixel, API, or CDN gets caught in this crossfire, expect data loss.
Generated Domain Patterns: Tracker Networks on Autopilot
A big chunk of new EasyList entries follows the same pattern: 1p81bmc2ux25lvtl3nr.rest, 2lylfkv6jg5muv6f9749zbczo2yx4553.rest, and others. These are clearly machine-generated, likely by a tracker or malvertising botnet rotating infrastructure faster than blocklists can keep up.
For MarTech teams: If you’re seeing a surge of failed requests to these domains in your logs, it’s not a coincidence. Blocklists are trying to keep pace with automated tracker domain churn, but don’t expect coverage to be perfect.
Numbers this period
| Block List Name | Domains Added | Domains Removed |
|---|---|---|
| Steven Black Unified Hosts (ads + malware) | 11,739 | 19,789 |
| AdGuard DNS Filter (ads) | 4,767 | 7,731 |
| AdGuard Base Filter (ads) | 4,376 | 7,701 |
| EasyList (ads) | 4,350 | 7,706 |
| Online Malicious URL Blocklist (malware) | 65 | 90 |
| uBlock Filters – Badware Risks (malware) | 99 | 1 |
| EasyPrivacy (tracking) | 92 | 2 |
| AdGuard Tracking Protection Filter (tracking) | 70 | 3 |
| Peter Lowe's Ad and Tracking Server List (tracking) | 10 | 8 |
| uBlock Filters – General (ads) | 3 | 2 |
| AdGuard Mobile Ads Filter (mobile) | 2 | 0 |
| uBlock Filters – Privacy (tracking) | 2 | 0 |
Next digest drops October 7, 2026. For real-time checks, head to isblocked.fyi.