russia-blocked-geosite: a regenerated geosite.dat of blocked domains

The output is a data file, not a program

The project description is precise about the output and about the mechanism. Every six hours it automatically generates GeoSite files, and those files contain lists of domains blocked by Roskomnadzor, the Russian internet regulator, aimed at traffic routers and proxy or VPN applications. The repository listing tells you how little of the work happens in the repository itself, because it contains only a .github directory, the licence and the readme. There is no source tree, no package manifest and no build script to read. The work happens in a pipeline that runs on a schedule and publishes artifacts, and the repository is the documentation of what those artifacts are and where to get them. That makes the project a good example of a category of infrastructure that is easy to overlook, where the value is a continuously refreshed file that many clients can consume, and where the important questions for a user are where the file is hosted, how fresh it is and what is inside it.

Where the blocked domain data comes from

The readme names the sources, and the first three are the blocklist feeds themselves. There is antifilter.download, the community edition of that project at community.antifilter.download, and re:filter, which is the filtered variant hosted as the Re-filter-lists repository. The project then layers on several lists that are not about Russian blocking at all, and this is where the file becomes more than a blocklist. The v2fly domain-list-community contributes all of its categories, which the readme describes as a huge list of domains broken down by many services, companies and categories. The AdGuard DNS filter contributes advertising domains, Peter Lowe's list contributes advertising domains as well, and WindowsSpyBlocker contributes the domains Windows uses, including for tracking and analytics collection. On top of that, the project pulls in additional domains from a separate runetfreedom repository, the russia-domains-list, and the readme redirects anyone who wants to suggest domains or categories to that repository instead. The practical effect is that one file mixes regulatory blocking with advertising filtering, operating system telemetry and service categories, and a user who wants only one of those has to pick the right category rather than the whole file.

The category list, and the two entries that are almost half a million lines

The categories are the API of the project, and the readme lists them all. Everything from the v2fly community list is present, so categories such as google, discord, youtube, twitter, meta and openai come for free and are the reason people adopt this file rather than a plain blocklist. Then there are the Russia specific ones. The ru-blocked category holds domains blocked in Russia, combining the community antifilter feed with the re:filter data. The ru-blocked-all category is the union of all three blocked domain sources, and the readme is blunt about it, stating that the list contains no fewer than 700 thousand domains and should be used with caution. The single-source categories are published too, ru-available-only-inside for domains reachable only from inside Russia, antifilter-download, which is described as almost 700 thousand domains and also to be used with caution, antifilter-download-community, and refilter. Then come the auxiliary groups, category-ads-all for advertising domains, and the three Windows groups, win-spy for the domains Windows uses for tracking and analytics, win-update for the update domains, and win-extra for the rest. The release also carries these categories as plain text files with the domain lists, which is the form to use if your client does not read the binary format.

Three mirrors, a checksum, and no release history to read

The distribution arrangement is the part a user touches, and it is designed around the fact that the file changes every six hours. The readme states that the links below always give the latest version of the files, and then lists three ways to get them. The first is a raw GitHub URL pointing at the release branch, for the geosite.dat file and its sha256sum. The second is the same file served through the JSDelivr content delivery network, again with the checksum. The third is a Fastly fronted variant of the JSDelivr path, with its checksum as well. Serving the same bytes from three networks matters more than it might seem, because the file is a dependency of somebody's routing configuration and a single origin is a single point of failure. Publishing a checksum next to each copy is the other half of the arrangement, and it lets a consumer verify that what it fetched is what the publisher generated. The releases themselves are named with timestamps, with three on 2026-08-10 alone, and the last push to the repository was on 2026-08-10. There is no changelog to read, because the content changes continuously and the meaningful history is in the upstream sources.

How the file plugs into the routing ecosystem

The related projects section explains where this file sits, and it is more useful than the category list for understanding the design. The runetfreedom russia-v2ray-rules-dat repository is a single source of geo files for v2ray, xray and sing-box, which is the multi-client distribution of the same idea. The russia-blocked-geoip repository does the same job for IP based data rather than domain based data. The russia-v2ray-custom-routing-list holds routing rules for different clients, and the geodat2srs project converts geoip and geosite.dat files into the srs format that sing-box reads. The acknowledgements give the lineage, with thanks to antifilter.download and re:filter for the blocked domain data, and to the Loyalsoldier v2ray-rules-dat project for the idea and the basis of this one. So the ecosystem is layered. A community list supplies the category vocabulary, this project regenerates the Russian part of it on a schedule, a sibling project regenerates the IP part, and converters translate the results into the format a particular client wants. For a user, that means the format is not the only choice, and picking the wrong one produces a file the client silently ignores.

What the licence allows and who should read the file carefully

Two things are worth checking before you build on this. The first is the licence, which is GPL-3.0, and for a data set rather than software the practical questions are about redistribution. The repository ships the generated file as a release artifact rather than as a source repository, and the readme points at the upstream data providers for the underlying blocklists, so the terms of the feeds you consume are a separate question from the terms of the generated output. The second is the shape of the data itself, and the readme flags it in the two largest categories. A file of nearly 700 thousand blocked domains is not the same artefact as a list of a few hundred, and the difference shows up in memory use in the client, in the time taken to match rules, and in the number of false positives, since a large aggregate list is more likely to contain a domain that is blocked for one reason but reachable through another path. That is why the categories are split the way they are, with the community-only list separated from the union of all three sources, and why the readme tells you to use the large ones with care. The pipeline being unattended also means the content changes under you, and the right operational habit is to pin what you consume in your own configuration rather than tracking the latest artifact every time it is rebuilt.

Editorial conclusion

Adopt this project if you run a proxy or VPN client that reads geosite rules and you want a single regenerated file that merges the Russian blocklists with the categories you already use from the community list. It does not fit a user who needs a per-country feed or a rule set that distinguishes blocked from merely unreachable, and it does not fit an operator who needs the underlying reasons for a block, since the generated file carries domains and nothing else. Before you point a client at it, download the checksum file and verify it, then read the two category sizes, because the README warns that the largest lists contain hundreds of thousands of domains and should be used with care.

Frequently asked questions

Official sources

1. Issues
2. License: GPL-3.0
3. README
4. Releases
5. runetfreedom/russia-blocked-geosite on GitHub