Turn a list of IOCs into STIX 2.1, MISP JSON, CSV, Suricata rules or a YARA skeleton.
New
Blocklist Converter
Runs locallyNew
Use Blocklist Converter
What it does
Paste domains, URLs or any text and get a blocklist for a hosts file, AdGuard or uBlock Origin, Pi-hole, an RPZ zone, dnsmasq or Unbound. Hosts are cut to their registrable domain with the Public Suffix List, and large platforms are held back so they are not blocked by accident.
It runs entirely in your browser: nothing you enter is uploaded.
Example
Drainer hosts, a GitHub Pages site and a Google Forms link
hxxps://connect.wallet-verify[.]example/claim
www.wallet-verify.example
https://example.github.io/airdrop
0.0.0.0 tracker.bad.example
docs.google.com/forms/d/e/demo/viewform3 lines written from 5 hosts found, reduced to 3 registrable domains.
Held back as protected: google[.]com (from docs[.]google[.]com). Phishing pages on big platforms are reported to the platform; tick "include anyway" only if you mean to block the whole name.
Each host is cut to its registrable domain with the Public Suffix List (2026-10-20). On private suffixes such as *.github.io, *.pages.dev, *.workers.dev or *.netlify.app the registrable domain is the host itself, so a whole platform is never blocked.
AdGuard / uBlock Origin (||domain^)
! Title: PhishDestroy blocklist
! Generated: 2026-10-20T17:10:02.223Z by https://phishdestroy.io/developer-tools/blocklist-converter
! Entries: 3 (registrable domains, subdomains included)
||bad.example^
||example.github.io^
||wallet-verify.example^
Download blocklist-adguard.txt
How each entry was built (3)AdGuard rules ||bad.example^, ||example.github.io^ and ||wallet-verify.example^. example.github.io stays a separate entry because github.io is a private suffix, and docs.google.com is held back as the protected domain google.com.
FAQ
What does the converter do with my input?
It refangs the text, takes every host name from URLs, hosts-file lines, adblock rules or plain text, removes duplicates, sorts the names and writes them in the chosen format. By default each host is cut to its registrable domain with the Public Suffix List, so login.evil.example and www.evil.example become one entry for evil.example.
Why are some names left out of the list?
Public suffixes such as com, co.uk or github.io are never written, because one entry would block every site under them. About 55 protected domains of large platforms (Google, Microsoft, Apple, GitHub, Cloudflare and others) are held back unless you tick include anyway, IP addresses are skipped because DNS blocklists match names, and hosts files only block the exact names listed.
Is my list sent anywhere?
No. Extraction, the Public Suffix List lookup and the conversion run in your browser, and the result is only copied or downloaded when you ask for it.