Add USOM (Turkey CERT) phishing & malware domain blocklist to AdGuard DNS

[rcelebi7]

Prerequisites

• I checked the documentation and found no answer;
• I checked to make sure that this issue has not already been filed;
• This is not an ad/bug report.

Problem description

AdGuard DNS currently does not include a country-specific security blocklist for Turkey.
USOM (Turkey's National Cyber Incident Response Center) publishes an official list of domains associated with phishing, fraud, and malware.
Integrating this list into AdGuard DNS would significantly improve protection for users, particularly in Turkey, against financial fraud and malicious websites.

Proposed solution

A production-ready, fully automated blocklist sourced from USOM has been created and is actively maintained. This solution is designed for reliability and requires no manual intervention to stay current.

• Provide a stable, permanent link to the blocklist, ready for integration:
  https://raw.githubusercontent.com/rcelebi7/USOM-AdGuard-DNS/main/USOM-AdGuard-DNS.txt

• The list is fully automated via GitHub Actions. It fetches new data, converts it to AdGuard syntax (||domain.com^), and publishes updates every Morning at 05:00 UTC.

• The list includes a professional, AdBlock-style header with metadata such as version number, last modified date, and the total number of entries for transparency and easier management.

• It is requested that this list be added under the "Security" category in AdGuard DNS filters to provide timely and targeted protection for users.

Additional information

• Source: The data is sourced directly from the official feed of the Turkish National Cyber Incident Response Center (USOM).
• Automation: The update process is managed by a public GitHub Actions workflow, viewable in the project repository.
• Homepage: The project's homepage and source code can be found at https://github.com/rcelebi7/USOM-AdGuard-DNS.
• Reliability: The build status is monitored and publicly displayed via a status badge on the project's homepage.
• List Size: ~400k-500k domains (the exact number is updated in the list header with each build).
• This integration would complement existing security filters by providing a valuable, region-specific layer of protection against current threats.

[Alex-302]

Hi.
Is it https://www.usom.gov.tr/url-list.txt converted to Adblock-style rules?
If so, we could add https://www.usom.gov.tr/url-list.txt directly, like
https://github.com/AdguardTeam/HostlistsRegistry/tree/f22262855678a69f0f9ac537ffea3f259d2da34d/filters/security/filter_42_ShadowWhisperersMalwareList
domains list can be converted by Hostlists Compiler.

[rcelebi7]

Hi. Is it https://www.usom.gov.tr/url-list.txt converted to Adblock-style rules? If so, we could add https://www.usom.gov.tr/url-list.txt directly, like https://github.com/AdguardTeam/HostlistsRegistry/tree/f22262855678a69f0f9ac537ffea3f259d2da34d/filters/security/filter_42_ShadowWhisperersMalwareList domains list can be converted by Hostlists Compiler.

Hi,

Yes, that's correct. This repository simply mirrors the official USOM URL and converts it to the AdGuard/Adblock format.

If you can add the source URL (https://www.usom.gov.tr/url-list.txt) directly and have your Hostlists Compiler process it, that sounds like a much more efficient and robust solution.

I'm glad that my project helped bring this valuable Turkish blocklist to your attention.

Thank you!

[rcelebi7]

@Alex-302
Hello,
When will this list be added to the paid AdGuard DNS service? Or will it be added at all?

[Alex-302]

This filter is quite large. It needs to be considered carefully.

[rcelebi7]

Hello @Alex-302

Thank you for your consideration. I would like to share a few additional details regarding the list:

The source of the list is an official Turkish institution (USOM).
It is continuously updated throughout the day.
The list primarily covers phishing and scam links that are common for Turkish users.
Users of AdGuard Home already include this list without any issues; however, not every user has the opportunity to run Home. Therefore, we kindly request its inclusion in AdGuard DNS.

We understand that the large number of rules may have implications for performance, loading time, and system resource usage. The assessment of these factors is, of course, at your discretion.

I hope you will consider this positively.
Best regards.

[xandaronox]

it also blocks normal domains. I dont accept this.

[rcelebi7]

it also blocks normal domains. I dont accept this.

You can clarify like this:

"This filter only blocks specific URLs pointing to malicious or fake APK files on Discord’s CDN. It does not block normal Discord domains or interfere with regular use of the service, such as chatting, uploading images, or accessing servers."

[toreador34]

it also blocks normal domains. I dont accept this.

USOM (abbreviated from the Turkish "Ulusal Siber Olaylara Müdahale Merkezi") is the National Computer Emergency Response Team of Turkey (CERT). In English, it is officially referred to as the "National Cyber Incident Response Center."

A key function of USOM is its URL filtering system. Internet Service Providers (ISPs) in Turkey often use the USOM blocklist to proactively prevent users from accessing known malicious online resources.

USOM blacklists the specific, malicious links hosted on the Discord CDN, but it does not block the Discord CDN domain itself. This is a precise measure to stop the spread of malware while minimizing disruption to legitimate services.

I personally use this list to safely protect my mother and a couple of other close relatives from being exposed to malicious links. This way, I ensure they don't download harmful files or enter phishing sites. Essentially, this is what the list is for—it serves this purpose perfectly and gives me peace of mind.

It would be a great development if this list were made available to the public, so that everyone could be protected from these harmful links and domains in the same way.

[koyunlu1984-jpg]

please add this list

[Alex-302]

We recently added a new anti-phishing source. It takes time to eliminate false positives.
We will consider adding this filter later.

[hagezi]

@Alex-302 This list contains 70% dead domains and often false positive domains. A “cleaned up” version is also included in my TIF.

See also: AdguardTeam/HostlistsRegistry#386