Check A/AAAA response against IP blocklists

[piholy]

It would be great if pi-hole were able to check the A/AAAA response from a domain query against IP blocklists and return 0.0.0.0.

Many malware hosting use the advantage of random subdomains to circumvent domain blocklists, others simply changes the domain but keeps the same IP. I know I can use regex for subdomains but it seems resource intensive. I don't know about you guys but I would take advantage of IP blocklists.

[jfb]

Can you provide an example of how this feature would work? And how this would be different than the existing CNAME blocking in Pi-hole V5 and later?

[yubiuser]

Closing as duplicate in favor of

pihole-FTL: block IP's from lists

I know pihole only can process lists, using specifically formatted DNS /URL entries. These lists are added to /etc/pihole/adlists.list. There are several lists on the web with only IP addresses, such as, but not limited to, the talos list, the firehole list, ... I was wondering if pihole-FTL could be modified to check these IP's, right before returning the resolved address to the client, replacing it with the appropriate IP address for blocking, if found on the list. Example assume ssl.goo…