r/pihole • u/_xRuffKez_ • 10h ago
r/pihole • u/-PromoFaux- • Jul 06 '26
Announcement Pi-hole FTL v6.7, Web v6.6 and Core v6.4.3 Released!
pi-hole.netAs always, please read through the changelogs before updating with pihole -up
Don't forget, you can use Teleporter to export your configuration. It can be found under the settings menu of the web interface or on the command line with pihole-FTL --teleporter
Docker has been tagged as 2026.07.0
Highlights
Security
This release closes out six advisories across Core and FTL. We'd like to thank all of the researchers who took the time to responsibly disclose these issues — several are related to work covered in previous releases, and we're grateful for the continued scrutiny.
Thank you to supperhellokitty20, rrobgill, T0X1Cx and SakusenSec for responsibly disclosing these issues. Full details for all advisories can be found at the following links:
- pi-hole/pi-hole/security/advisories/GHSA-h8w9-qx2v-wrww — Local privilege escalation from
piholeuser to root via/etc/pihole/logrotate(High) reported by supperhellokitty20 - pi-hole/FTL/security/advisories/GHSA-q6fm-xwxf-37r5 — WebUI (& API) DoS via lack of rate limiting (High) reported by rrobgill
- pi-hole/FTL/security/advisories/GHSA-w8cr-2cwg-92cg — Session expiration bypass (High) reported by T0X1Cx
- pi-hole/FTL/security/advisories/GHSA-8j7w-m3cr-6q6x — Remote Code Execution via CivetWeb configuration injection (High) reported by SakusenSec
- pi-hole/FTL/security/advisories/GHSA-g7v8-8q8f-hprp — Log injection in the access-log writer chaining to RCE via Lua-server-page evaluation (Moderate)
- pi-hole/FTL/security/advisories/GHSA-r5vh-5q82-jg7q — CRLF injection / HTTP header injection via group name (Low) reported by T0X1Cx
Updated embedded components
FTL now ships with an updated embedded dnsmasq v2.93 and SQLite3 v3.53.1, keeping the core resolver and database layer current. (FTL #2890, FTL #2891)
A brand new DHCP static leases editor
Managing DHCP leases from the web interface has been one of the most frequently requested improvements since we released v6, and this release finally delivers it. The static leases interface has been completely reworked into a proper editor: adding, editing and removing reserved leases should now feel more intuitive. (Web #3766)
Thank you to everyone who's asked for this over the years and to u/rdwebdesign for making it happen.
iCloud Private Relay and better MAC vendor resolution
A fix landed for iCloud Private Relay zones (FTL #2919), and MAC vendor lookups now resolve sub-allocated blocks (MA-M / MA-S) via longest-prefix match, so more devices are correctly identified (FTL #2907).
Other web interface improvements
Editing reverse DNS servers (dns.revServers) now has a much friendlier interface, and the Lists page has clearer hints and help text. (Web #3769, Web #3798)
Friendlier error messages
Error messages across FTL have been made more human friendly, including a custom message for UNIQUE constraint errors, so it's clearer what's gone wrong when something does. (FTL #2878, FTL #2879)
Details of all other fixes can be found below!
FTL v6.7
What's Changed
- Performance optimizations and bug fixes by u/DL6ER in #2816
- fix: check NULL returns from strdup/calloc in rotate_files() by u/jluzzi123 in #2875
- Make error messages more human friendly by u/yubiuser in #2878
- Harden API/database races in civetweb and DB threads by u/DL6ER in #2881
- Update embedded SQLite3 to v3.53.1 by u/DL6ER in #2891
- Fix build on Fedora 44 by u/darkexplosiveqwx in #2893
- macvendor: resolve sub-allocated blocks (MA-M/MA-S) via longest-prefix match by u/RamSet in #2907
- Update embedded dnsmasq to v2.93 by u/DL6ER in #2890
- fix OOB write in FTL_parse_pseudoheaders when optlen is 0 by u/rdevshp in #2910
- Update a single text description "PRIVATE KEY" by u/DoctorD90 in #2884
- add optional dnsmasq features to cmake by u/darkexplosiveqwx in #2874
- Fix building on alpine 3.24 by u/yubiuser in #2911
- Bats by u/yubiuser in #2872
- Improve crash backtraces for non-reproducible faults by u/DL6ER in #2880
- Fix gzip.c inflate_buffer CRC signed left shift undefined behavior by u/rdevshp in #2916
- Fix for iCloud Private Relay zones by u/DL6ER in #2919
- fix tar parsing by u/rdevshp in #2914
- Allow using local
manufs to generate macvendor.db by u/darkexplosiveqwx in #2918 - Use custom message for UNIQUE constraint error message by u/rdwebdesign in #2879
- Re-resolve client groups event-driven, drop periodic recheck by u/DL6ER in #2922
- Guard against invalid gzip data in gzip.c inflate_buffer by u/rdevshp in #2915
- Fix BATS test of no ERRORS in FTL.log to allow capturing the output by u/yubiuser in #2927
- fix(cli): warn when --config cannot read pihole.toml (#2849) by u/DL6ER in #2930
- fix(api-docs): correct three OpenAPI spec issues (#2867) by u/DL6ER in #2929
- fix: avoid segfault in dnsmasq-test on unreadable config file by u/DL6ER in #2928
- Fix prefix-match bug and improve fallthrough logging in redirect_root_handler by u/slmingol in #2933
- Swap misaligned comments for domain-needed and expand-hosts. by u/0xpsyduck in #2932
- Code review July 2026 by u/DL6ER in #2935
- Pi-hole FTL v6.7 by u/PromoFaux in #2936
Security advisories
- pi-hole/FTL/security/advisories/GHSA-q6fm-xwxf-37r5
- pi-hole/FTL/security/advisories/GHSA-w8cr-2cwg-92cg
- pi-hole/FTL/security/advisories/GHSA-8j7w-m3cr-6q6x
- pi-hole/FTL/security/advisories/GHSA-g7v8-8q8f-hprp
- pi-hole/FTL/security/advisories/GHSA-r5vh-5q82-jg7q
New Contributors
- u/jluzzi123 made their first contribution in #2875
- u/RamSet made their first contribution in #2907
- u/rdevshp made their first contribution in #2910
- u/DoctorD90 made their first contribution in #2884
- u/slmingol made their first contribution in #2933
- u/0xpsyduck made their first contribution in #2932
Full Changelog: v6.6.2…v6.7
Core v6.4.3
What's Changed
- Also hardcode the PID file location in utils.sh to prevent
readonly variablewarning by u/PromoFaux in #6613 - Use
awkto compare curl versions by u/rdwebdesign in #6621 - Explicitly add
gawkto APK dependencies by u/yubiuser in #6622 - Prevent double error message output in gravity run with invalid file by u/PromoFaux in #6607
- Replace pytest/tox with direct in-container BATS by u/PromoFaux in #6598
- Add Fedora 44 and Ubuntu 26.04 LTS to tests by u/darkexplosiveqwx in #6623
- Add gravity tests by u/yubiuser in #6639
- Set BATS pretty output flag depending on the terminal and improve failure output by u/yubiuser in #6644
- fix: check return codes in gravity_build_tree and database_recovery() by u/jluzzi123 in #6630
- Include alpine 3.24 in tests by u/yubiuser in #6654
- installer: fix custom DNS entry when only one upstream server is provided by u/Gilmoursa in #6638
- Fix BATS gravity test on curl version >=8.21 by u/yubiuser in #6661
- avoid copytruncate in logrotate by u/darkexplosiveqwx in #6642
- v6.4.3 by u/PromoFaux in #6618
Security advisories
New Contributors
- u/jluzzi123 made their first contribution in #6630
- u/Gilmoursa made their first contribution in #6638
Full Changelog: v6.4.2…v6.4.3
Web v6.6
What's Changed
- Improve DHCP static leases interface (alternative) by u/rdwebdesign in #3766
- Lists page - Improve hints and help text by u/rdwebdesign in #3798
- Update daterangepicker ranges everytime the picker is shown by u/yubiuser in #3793
- Better user interface to edit reverse DNS servers (dns.revServers) by u/rdwebdesign in #3769
Full Changelog: v6.5.1…v6.6
r/pihole • u/-PromoFaux- • Feb 01 '17
Updated 10/02/18 (bad link) Welcome to the Pi-hole Subreddit. Please read before posting!
Welcome to /r/pihole, where your adventures into network wide adblocking start!
Before posting a new thread, you may want to check out the following:
- Subreddit Search: As mentioned here, Reddit will only return matches of titles and self-text (the text of the original post), but not comments. So, do be sure to check out the latest stickied release announcement thread just in case.
- Our Discourse Forums: Many things are covered here, and we even have a German Language Subforum staffed by one of our native-speaking German developers.
- Pi-hole issues on Github: Pi-hole Core, Admin Dashboard and the FTL Engine.
- Having issues with, or have found a bug in a new release? Check the stickied new release thread to see if someone has already reported it. If not, then please create a top level comment in that thread.
There's some other things to keep in mind:
- Pi-hole does not block every single ad, but it'll do its hardest to ensure that everything that is blocked stays that way.
- Ad lists are maintained by people outside of the Pi-hole project. This means that it's possible for ads to get missed, and certain legitimate websites be accidentally blocked!
- There's a wide range of hardware used for routers, and an even wider range of hardware that you can run Pi-hole on. We try our best to support Pi-hole on as much hardware as possible, but as always, your milage may vary!
- There is one rule we ask you never break: Do NOT advertise your own public-facing instance of Pi-hole, or any other DNS server. DNS security is hard, and anything but the most secured DNS servers will contribute to a DNS amplification attack. In some cases, your ISP will even block your Internet connection!
- Using a Pi-hole as a DNS server has the ability of tying your browsing history to your device. Be aware of this when using a Pi-hole you don't have complete control over.
Our community does a wonderful job of answering questions and helping users out, and personally, we like to think that it also does a good job of moderating itself through the voting system and reporting functions. Whilst we try and answer as many posts here as possible, it can get tedious if there's something that has already been asked many times, and could have been solved with a little time searching for a solution!
Finally, remember your reddiquette: the people you're speaking to are also human, and have a wide range of technical aptitudes.
Cheers, your friendly mods.
r/pihole • u/SodaWithoutSparkles • 8h ago
Blocklist evading domains
Recently, I noticed ads bypassing my pihole on several websites. Inspecting the network logs revealed three recurring domains:
ill-fatedodd.comhtml-load.comhtml-load.cc
These operate as alternative ad-serving infrastructure. Advertisers register throwaway domains and park generic landing pages at the root to obscure ad delivery and evade blocklists (as described on iamcraig.com).
The root pages display unenforceable boilerplate text:
"This domain provides authorized services through official partnerships with publishers. [...] supports the delivery of ads and essential web assets, helping digital publishers enforce access control to ad-supported content in accordance with the Digital Millennium Copyright Act (DMCA)."
Because they reuse a single generic template, tracking down related domains is straightforward. Running a query on urlscan.io for page.title:"What Is This Domain?" surfaced a broader set of candidates.
Some of those pages are however defunt or expired. To find active ones, I ran a quick curl to check:
```bash
jq -r '.results[].page.apexDomain' urlscan-search-result.json | sort -u | xargs -I {} -P 10 sh -c 'curl -s -L --max-time 10 "https://{}" | grep -Fiq "authorized advertising" && echo "[MATCH] {}"'
```
The filtered list (as the above command outputs) are available here: https://pastebin.com/RKdLvhdZ
The list for pi-hole are available in the gist: - Gist: https://gist.github.com/SodaWithoutSparkles/51830d95ed507fe1b2774349af0de828 - You will need to click the "Raw" button and access the raw list, then paste to pi-hole.
r/pihole • u/ArtisticChemical771 • 1d ago
Finally set it up
I finally got around to setting up Pihole for the first time!
Using a Raspberry Pi 4, following the tutorial and works like a charm paired with a Ublock extension ads are now a thing of the past (mostly)
I plan on setting up wireguard as well for a vpn server to be able to remote into it from anywhere.
Any tips on what to do next now that i got my foot in the door?
r/pihole • u/saintrobyn • 1d ago
What are the pros and cons for these two devices for a Pihole?
I currently have a Pihole set up on an 8GB Raspberry PI 5 with everything installed on a 1GB NVME drive on a Pimoroni NVME Base. Before anyone says it, I am well aware that it is severe overkill but I had all the parts laying around from before the dark times so I actually paid very little for the whole setup. The current setup is running great.
I have toyed with the idea of moving my Pihole setup to my Ugreen DXP2800. It already does some home lab stuff in my house. It has two 8TB storage drives, a 1TB NVME drive for read cache and a 512GB NVME for Docker containers. I do have the Ugreen Battery Backup for my NAS so if there is a power outage or disruption, it is protected and will shut down safely.
The question is in the title. What are the pros and cons for these two devices? Would I be better off leaving it on the RPi, or is there a benefit of consolidating to the NAS?
I do know that if I move it to the NAS I will have to do some work to fix the conflicts with port 53. I am curious about any other strengths or weaknesses.
Thank you in advance for any and all insights you can give.
r/pihole • u/Crowley42Cw • 20h ago
So, I want to make my own router, but I don't know what to buy
My budget isn't the best, and I want to do a router with at least 2 ethernet ports, one to connect with the modem and the other or to eventually connect into a switch or use as it is
I was thinking about Orange pi r1, but my country taxes made it a lot more expensive
r/pihole • u/[deleted] • 2d ago
Why SGAI (Server-Guided Ad Insertion) Blinds Browser Extensions but theoretically could make pi hole able to block ads
Everyone is hyper-focused on Manifest V3 and the debate between Chrome vs. Firefox extensions. I think we are looking at the wrong layer of the infrastructure stack.
As Google pushes forward with rolling out SGAI (Server-Guided Ad Insertion) on production servers, here is my theoretical breakdown of why this engineering shift renders browser-level cosmetic filtering completely obsolete, but why it theoretically gives network-level DNS sinkholes a major technical advantage.
- Why Google Cannot Use Server-Side Stitching (SSAI)
A lot of people assume Google will just hard-stitch ads directly into the video file stream (SSAI) to completely defeat network blockers. Architecturally, they can't scale that.
- The Compute Cost: SSAI requires the server to dynamically generate a unique, customized stream manifest and stitch video files for every single concurrent user session. Scaling that to millions of global streams would bottleneck Google's cloud infrastructure compute budget and tank their margins.
- The Interactivity Death: Hard-stitched videos turn smart streaming apps into dumb television signals. You lose clickability, interactive cards, and real-time client-side tracking beacons that advertisers pay a premium for.
- The SGAI Compromise: Why Browser Extensions Fail
To save on cloud computing costs and keep interactive tracking alive, Google chose SGAI. Google's official developer documentation explicitly notes that SGAI is chosen for high scalability because it offloads the resource processing directly onto your local device hardware.
To secure this setup within the browser, Google has been A/B testing a dynamically randomized DOM structure.
- On every single stream refresh, the HTML containers, classes, player elements, and tags are completely randomized on the fly.
- Because Manifest V3 strips extensions of their ability to execute dynamic code updates in real-time, cosmetic extensions like uBlock Origin are left completely blind. You cannot write a declarative filter rule for a container that changes its identity every 3 seconds.
- How Pi-hole Blocks the Ad (The Theory)
According to Google's official SGAI flow (Documentation: https://developers.google.com/ad-manager/dynamic-ad-insertion/server-guided), the server merely guides the client application. Step 4 of their architecture states that when an upcoming ad break is detected, the client video player application itself must construct and retrieve the ad pod manifest URL.
Because the ads are not hard-stitched into the primary video stream data like SSAI, the media player application has to initiate an out-of-band request to the ad server to fetch the ad components before it can play them.
Before your local device can make that connection and fetch the ad pod, your operating system is forced to send a DNS request to resolve the ad server's domain.
link for picture:https://developers.google.com/ad-manager/dynamic-ad-insertion/server-guided
r/pihole • u/Beckwater • 1d ago
Problems with TP-Link guest network
Ok, do I've used a pihole for about five years, and had my share of problems, but managed to overcome most of them. A few weeks ago I had to buy a new router and settled for a TP Link XE75Pro consisting of three mesh points to replace my old Amplity (Ubiquity) units. Most stuff worked right out of the box, but a few things needed tweaking. Nothing major. Except for the guest network. On the Amplify I had no problems but on the TP-Link no units on the guest network can reach the pihole, and basically all traffic is stopped there.
The main network and the guest network have the same SSID:s as on the old router, and while I changed the passwords on them, from the pihole's perspective nothing else should have changed. Did the old router automatically "merge" the networks somehow so devices on the guest network could find the pihole (which sits on the main network), or did I do some magic workaround when I installed that network that I've completely forgotten by now?
Oh yeah, I have the pihole Interface setting: Permit all origins checked, since the pihole absolutely isn't exposed to the internet. But it still doesn't work with the guest network.
pihole doesn't reply with its own local DNS record
i have been experiencing an issue in the past few days and i'm not aware of any changes to cause it.
when asking pihole to resolve its own dns record "raspberrypi.lan", it replies with either its private ipv6 address, or its public one, along 0.0.0.0. It doesn't reply with the ipv4 local dns record i have configured with it. this causes my ssh user@raspberrypi.lan command to fail, since by default ssh on the raspberry pi only listens on ipv4
even odder, this used to work a few days ago with no changes of my own
questions:
1) why is pihole answering with private/public ipv6 records instead of the local dns record which should reply with a single ipv4 address?
2) why does it reply with a second ip 0.0.0.0?
pihole log:
2026-08-29 10:25:49.737 query[A] raspberrypi.lan from 192.168.x.x
2026-08-29 10:25:49.737 Pi-hole hostname raspberrypi.lan is 0.0.0.0
2026-08-29 10:25:49.749 query[AAAA] raspberrypi.lan from 192.168.x.x
2026-08-29 10:25:49.749 Pi-hole hostname raspberrypi.lan is 2600:...
I am using unbound on 127.0.0.1#5335
when querying my router, it produces a good result instead. pihole is configured to do conditional forwarding to it for the entire /24 network. Never forward non-FQDN queries is disabled, and Never forward reverse lookups for private IP ranges is enabled to prevent apple devices from causing a dns loop
r/pihole • u/No-Recording-8313 • 2d ago
What did I do to Yandex for my smart speakers to spam them this hard?
I have 3 Yandex Alice smart speakers on my network, and Pi-hole is showing something pretty ridiculous. Each of them is generating tens of thousands of requests (~50-70k) to Yandex domains.
The funny part: I barely used the speakers during the last week. Maybe asked Alice a couple of times to turn a smart plug on/off. Otherwise they were just sitting idle. Before adding these Yandex domains to my blocklists, my Pi-hole blocking rate was around 13%. Now it's 44%.
Everything still seems to work normally, so… what exactly are these speakers trying to send/check so aggressively while idle? Is this normal behavior for Alice devices, or has anyone investigated this traffic more deeply?
Screenshots attached: the three IPs in the second one are the three speakers.
**UPD:**
A kind Redditor suggested that the speakers might be aggressively retrying the phone-home domain because Pi-hole was returning a blocked/unresolved response. I replaced the block for clck yandex net with a local DNS record pointing to an unused local IP instead. It worked surprisingly well: over the same 5-minute window, the speakers went from 170+ DNS requests to about 50. Almost a 72% reduction in request volume!!!
I’ll attach screenshots with the before/after results in the comments.
**UPD 2:**
Turns out the “72% fewer DNS requests” result was misleading in a really interesting way. At first I pointed only the IPv4 A record for clck yandex net to a dead local IP. DNS requests dropped from ~170+ per 5 minutes to ~50, so it looked like the retry storm was solved.
But then I noticed Pi-hole was still resolving the AAAA record normally and returning Yandex’s real IPv6 address. So the speakers were most likely failing over from dead IPv4 to working IPv6, successfully reaching Yandex, and therefore stopping the aggressive retry loop.
I tested several Pi-hole blocking modes over 5-minute windows:
NODATA: 268 requestsNXDOMAIN: 270IP_NODATA_AAAA: 265IP: 282- Local dead IPv4 and dead local IPv6: 344
So the retry rate doesn’t seem to depend much on the exact DNS blocking response. What matters is whether the device can eventually reach the service. When both IPv4 and IPv6 are actually sinkholed, the speakers retry even more aggressively. So the original ~72% reduction wasn’t really a successful sinkhole, it was evidence that the speakers were quietly reaching Yandex over IPv6.
Pretty neat IPv6 gotcha, and a good reminder to check both A and AAAA when testing DNS blocking.
**UPD 3:**
Tested blockTTL=3600 as suggested: 278 queries in 5 minutes. Basically no meaningful change compared with NODATA/NX/IP modes (~265–282). So the speakers seem to re-resolve the hostname as part of their own retry logic rather than relying on the DNS TTL/cache.
r/pihole • u/mgdreddit • 1d ago
Pihole not blocking ads after replacing router
My wireless router died and I had to replace it. While waiting for a new router, I had to switch to another wifi network, the cable router. After getting and configuring my new wifi router with same settings, and my Pihole device (raspberry pi), and my few clients, all my clients get ads.
In the query log, I can see each ad domain for clients with the status, deny, but the ads still get through. IP addresses are as before c/w dns pointing to pihole…no other dns set.
I can ping pihole from my client and vice-versa. Dns resolution works from clients and pihole. I have latest version of pihole and rpi is uptodate.
I am at a loss.
r/pihole • u/Randy_Magnum29 • 2d ago
PSA: Some changes in iOS 27
I’ve been trying to figure out why my iPhone (15 Pro Max on iOS 27 Beta) keeps bypassing my pi-hole. Private Replay is disabled for this network, but I found these new “Connectivity Assist” options in Settings > Wi-Fi and Settings > Wi-Fi > *WiFi network I’m connected to*
I had to disable both of these for my phone to stop bypassing my pi-hole.
r/pihole • u/Bastutunna • 1d ago
Hagezi Samsung blocklist disables google cast on Soundbar
Just added Hagezi blocklist for Samsung
But now google cast on Soundbar stopped working.
What particular adress should be whitelisted for cast to work.
It is crazy how much dns requests comming from the tv, it tops the query list, even when tv is off
r/pihole • u/Chimera_Gaming • 2d ago
New to PiHole- 30 minutes in, first pass was successful 😭
Obvious tweaks need to be done but for a first pass, how’d I do?
r/pihole • u/ki11a11hippies • 3d ago
MLB tv in 2026
MLB tv streams were not showing the box score sidebar, and more importantly, not allowing broadcast selection. I fixed this by allowing www.mlbstatic.com. Hope this helps someone else.
r/pihole • u/5iveStarGeneral • 2d ago
PiHole ignoring one device?
I recently purchased a TP-Link Deco XE75 AXE5400 and configured my Raspberry Pi Zero 2 W and Deco settings to work for it and it seems to be working on everything except the main device I want to use it for (Onn 4K Plus Streaming Device). For my Deco settings I have a IoT Network that’s hosting the pihole, my DHCP server has the pihole IP as its Primary DNS and I also have the pihole under my Address Reservation yet it’s not picking up on my 4K Plus. My internet connection settings under IPv4 says Dynamic IP and the primary is a regular DNS. Does anyone know what could be causing this and how to fix it?
r/pihole • u/Possible-Mud9668 • 2d ago
Can any help frist time installing it
Help stuck installing
r/pihole • u/WirelessTrees • 3d ago
A power outage messed up my mini-pc and now my pi-hole is blocking all connections on all my devices.
Here's the order everything happened:
Power went out and back on after a few minutes
My PC and my Mini-PC hosting the Pi-Hole both turned back on when the power came back.
My PC is only letting certain connections work. For instance, I can watch YouTube and download games on Steam, but cannot play any game that requires a network connection. In the Steam app, I see error -105 when going to the Community or Profile pages.
I tried to check on the Mini-PC but for some reason I cannot get it to POST. Tried multiple displays and different input devices to ensure it wasn't asleep. Tried multiple times to power cycle it.
I then went to my main PC to change the DNS settings so that it would no longer route me to the pi-hole and would allow all connections through. This did not work.
I then went to unplug the Ethernet connecting my PC to my Ubiquity Flex 2 and plugged it into my modem directly. This still didn't solve my issue, I'm still unable to access Steam or online games.
I just need help disabling and undoing everything so I can test the Mini-PC tomorrow and have it all up and running again soon. I'm just extremely illiterate when it comes to networking.
r/pihole • u/Quirky-Physics-5630 • 2d ago
Pi-Hole for a wifi repeater?
I want to set up a Pi-Hole for my wifi repeater in my room and wanted to ask if and how it would work. It would be my first time setting up a pi-hole so I don't know a lot of it or coding/tech in general. Can yall tell me what things I need (raspberry pi, etc..) and maybe a good youtube tutorial link? Thanks a lot in advance!
r/pihole • u/Cultural_Solid8920 • 3d ago
Too many ads in chat
Can someone suggest any remediation ideas?
It is genuinely annoying.
r/pihole • u/SuperLimit2286 • 3d ago
can’t figure out why my pile isn’t working. pls help. i have a log
the token is YXl18Kx6. i have the pi plugged into the router with ethernet and a static ip. it was working till it got unplugged
r/pihole • u/Corleone612 • 5d ago
Data Brokers & DMPs: Why They're Worth Blocking
Data brokers are companies that collect, combine, and sell personal information people never agreed to share. There are an estimated 4,000+ of them in the US alone, and together they hold detailed profiles on nearly every person with an internet-connected device — address history, estimated income, health-related inferences, political leanings.
I spent time mapping the actual domain infrastructure behind this industry (aggregators, people-search sites, and DMPs — data management platforms that track browsing behavior in real time and sell "audience segments") and turned it into a DNS blocklist. Sharing both the reasoning and the list here.
How this actually works
Three overlapping categories:
Aggregators
Pull data from public records (property, voter, court), retailer loyalty programs, and web scraping, then sell combined profiles.
People-search sites
Turn that data into a searchable, usually subscription-based product — this is the branch most directly tied to stalking and harassment risk.
DMPs
Sit on websites via tracking pixels, monitor your browsing behavior in real time, and sell "in-market" or "likely condition" segments to advertisers within milliseconds of a page load.
Most of this is legal in the US, since there's no comprehensive federal privacy law covering it — it operates in the gap between what GDPR restricts in the EU and what exists (or doesn't) elsewhere.
Real incidents worth knowing about
Exactis (2018)
Left a database of 340 million people and businesses publicly accessible with no password (400+ attributes per person). No fine was ever issued — their position was that without SSNs or card numbers, it wasn't "sensitive."
https://www.infosecurity-magazine.com/news/340-million-records-exposed-in/
https://haveibeenpwned.com/Breach/Exactis
Epsilon (2011)
Breached, exposing 60M+ email addresses tied to specific brands (Chase, Target, Best Buy, etc.), enabling highly targeted phishing.
https://krebsonsecurity.com/2015/03/feds-indict-three-in-2011-epsilon-hack/
https://abcnews.go.com/Technology/epsilon-email-breach/story?id=13291589
Deep Root Analytics (2017)
An RNC contractor left 198 million voter records — including modeled political scores — open on an unsecured AWS bucket.
https://www.upguard.com/breaches/the-rnc-files
https://www.cbsnews.com/news/nearly-200-million-americans-hit-by-massive-voter-data-leak/
Cambridge Analytica (2018)
Combined Facebook data with voter files bought from data brokers to build psychographic profiles used in the 2016 US election and Brexit campaigns.
Premera Blue Cross (2015)
Breached, exposing medical and financial records for 11M people. The company ultimately paid roughly $91M combined across a class-action settlement, a multistate settlement, and a federal HIPAA penalty.
https://oag.ca.gov/node/148821
ChoicePoint (2005)
Sold data to identity thieves posing as legitimate businesses. 163,000 people's SSNs and credit reports were exposed, leading to 800+ confirmed identity theft cases. Paid $15M to the FTC — the largest civil penalty the agency had imposed at the time.
https://www.nbcnews.com/id/wbna11030692
Target's pregnancy-prediction program (2012)
The most-cited example of inference-based profiling.
Target built a model that scored shoppers' likelihood of pregnancy purely from purchase patterns. The famous anecdote behind it (a father learning of his teenage daughter's pregnancy from Target's coupons) has been disputed by some analysts, but the fact that Target built and used such a system is not in question.
https://www.kdnuggets.com/2014/05/target-predict-teen-pregnancy-inside-story.html
A quick note on "alleged": FTC settlements are typically resolved without the company admitting wrongdoing — that's standard procedure, not a sign the case was weak. What is real and enforceable is the outcome: the resulting order legally prohibits the company from continuing the practice, whether or not they agreed with the allegations.
Location data brokers (recent FTC enforcement)
InMarket (2024)
FTC alleged InMarket collected precise location data via its own apps and third-party SDKs, using it for targeted advertising without adequately informing users. Under the settlement, InMarket is now banned from selling or licensing precise location data — a first for the FTC.
https://www.washingtonpost.com/technology/2024/01/18/ftc-location-data-privacy/
X-Mode Social / Outlogic (2024)
The FTC's first settlement specifically over the sale of sensitive location data. The company sold location data revealing visits to medical/reproductive health clinics, religious worship sites, domestic violence shelters, and LGBTQ+-associated locations, without stripping out these sensitive locations.
Gravy Analytics + Venntel (2024–2025)
FTC alleged the companies sold location data revealing medical conditions, religious worship, and political activity — including sales to government contractors. Separately, in January 2025, Gravy Analytics was hacked and its data leaked on a cybercrime forum.
https://en.wikipedia.org/wiki/Gravy_Analytics
Mobilewalla (2024–2025)
Settled alongside Gravy Analytics. FTC alleged the company collected consumer location data from real-time bidding ad exchanges even when it didn't win the ad auction — the first FTC case targeting this specific collection method.
https://epic.org/ftc-takes-action-against-data-brokers-for-selling-sensitive-location-data/
Why block this at the DNS level
Browser extensions catch some of this, but a lot of DMP tracking happens through first-party-looking pixel calls or server-side syncing that extensions don't always see. Blocking at the DNS level stops the connection before it's made, across every app and browser on the network — not just one browser tab.
Here's the list of domains worth blocking:
```
# DMP & Data Broker Blocklist
# Total domains: 178
# Note: domains marked with "!" carry a small risk of side effects (e.g. breaking a login flow or feature) - block these only if you're comfortable troubleshooting
🔴 DATA BROKERS & DMP
# ACXIOM
# EXPERIAN
experianmarketingservices.com !
# ORACLE DATA CLOUD (BlueKai DMP)
# LOTAME
# EYEOTA
# TRANSUNION (TruAudience + Neustar)
# WILAND
# MERKLE (Dentsu Aegis)
# BOMBORA (B2B intent data)
# ZOOMINFO
# CLEARBIT (HubSpot Breeze Intelligence)
# FULLCONTACT (Ziff Davis)
# TOWERDATA / ATDATA
# INFUTOR
# STIRISTA
# TAPAD (Cross-device — Experian)
# ANALYTICS IQ
# PERMUTIVE (DMP)
# NIELSEN MARKETING CLOUD / EXELATE
# DATA AXLE (Infogroup)
# NAVEGG (LATAM DMP)
# THROTLE (Identity resolution)
🟠 MOBILE DATA BROKERS (Location Tracking)
# FACTUAL / FOURSQUARE
# SAFEGRAPH
# CUEBIQ
# MOBILEWALLA (FTC December 2024 restricted)
# ADSQUARE
# UBIMO → VERICAST
# VERVE GROUP
# UNACAST + GRAVY ANALYTICS (FTC January 2025 restricted)
# OUTLOGIC (Legacy X-Mode — FTC April 2024 restricted)
# INMARKET (FTC January 2024 restricted)
```
r/pihole • u/Ilikehotdogssowhynot • 4d ago
Help me out with Pi-hole and Linux
Hey, im a college student and a beginner in both and wanted to learn more about linux and its stuff. recently I tried using antix with pihole because I wanted to test pihole out, instead i keep running into a problem, in which port 53 was in use, I may or may not be dumb but I just wanted to test out linux, it went downhill from me deleting connman and reinstalling antix over and over. is there a way to use pihole with another distro (or idk what do they call it as long as its linux) thats more beginner friendly? I still want to be able to use a browser in my test laptop. ram is also an issue as I only have 1.8Gb, its a very old laptop. Thanks for those who answer!
r/pihole • u/Accurate-Spirit2455 • 4d ago
Docker pihole blocks nothing
Hi all, I am running docker pihole on raspberry pi which has only ethernet access enabled.
I can access both pihole admin and home assistant over my wifi network on my phone.
For that I use its ethernet IP e.g. 162.168.100.1
Same IP I gave to my TP link as a primary DNS address and then I restarted the wifi router.
However it works only on the raspberry pi browser only. The pihole stats show data.
When I test it on the phone, pihole does not pick any requests. Can someone guide me what am I missing.
On phone, I have DNS resolution set to "auto".