Extract top blocked domain from pi-hole using bash

So, I wanted to look around and see what are my top blocked domains on my local network. As far as I know, web interface of pi-hole is offering to just show you top N blocked domains. I wanted them all.

So, once I figured out it is all in log files in `/var/log/`, it all boiled down to figure out how to detect blocked domains and then it was just one simple script:

```
cat pihole.log | grep "0.0.0.0$" | sed -e "s/.*\s\(.*\)\sis 0.0.0.0/\1/g" | sort | uniq -c | sort -nr
```

Output of the script for me looks like:


   790 mobile.pipe.aria.microsoft.com
   116 winatp-gw-eus.microsoft.com
    52 us-v20.events.data.microsoft.com
    50 tracker.grepler.com
    50 ads.viber.com
    47 v10c.events.data.microsoft.com
    46 settings-win.data.microsoft.com
    40 tracker.trackerfix.com
    16 nexusrules.officeapps.live.com
     6 browser.pipe.aria.microsoft.com
     4 watson.telemetry.microsoft.com
     3 v10.events.data.microsoft.com
     2 nexus.officeapps.live.com
     2 az416426.vo.msecnd.net
     1 vortex.data.microsoft.com

Yes, there are lot of Windows machines on my network:) But since I use ad-tracker, there you cannot see lot of ads blocked.

Here is another example from another of mine pihole servers. This one is:

* outside of my network,
* has lot more of lists obtained from this [awesome aggregator](https://firebog.net/),
* family members are not the only users here, and
* is used in conjuction with openVPN, so I am covered on my mobile too

So, here it is:

   2516 mobile.pipe.aria.microsoft.com
     54 app-measurement.com
     31 reports.crashlytics.com
      8 www.googletagmanager.com
      8 www.google-analytics.com
      4 www.googletagservices.com
      4 static.chartbeat.com
      4 js-agent.newrelic.com
      4 googleads.g.doubleclick.net
      4 dev.visualwebsiteoptimizer.com
      3 sb.scorecardresearch.com
      3 cdn.optimizely.com
      2 static.doubleclick.net
      2 settings.crashlytics.com
      2 secure-us.imrworldwide.com
      2 s.webtrends.com
      2 realtime.services.disqus.com
      2 pagead2.googlesyndication.com
      2 logs-01.loggly.com
      2 load.sumome.com
      2 d1z2jf7jlzjs58.cloudfront.net
      2 cdn.segment.io
      2 c1.rfihub.net
      2 c.amazon-adsystem.com
      2 ads.mopub.com
      1 www.zergnet.com
      1 video.adaptv.advertising.com
      1 stats.wp.com
      1 ssl.google-analytics.com
      1 secure.quantserve.com
      1 s.skimresources.com
      1 s.adroll.com
      1 referrer.disqus.com
      1 platform.tumblr.com
      1 pixel.wp.com
      1 p.typekit.net
      1 nexusrules.officeapps.live.com
      1 mads.amazon-adsystem.com
      1 live.sekindo.com
      1 hello.myfonts.net
      1 experience.contextly.com
      1 events.redditmedia.com
      1 engine.adzerk.net
      1 device-metrics-us.amazon.com
      1 d3ezl4ajpp2zy8.cloudfront.net
      1 cx.atdmt.com
      1 collector-medium.lightstep.com
      1 cdn.simpleanalytics.io
      1 cdn.onesignal.com
      1 api.branch.io
      1 ads.adthrive.com
      1 ad-delivery.net

Stay safe online, friends;)

tags: bash,bash-magic,pihole,pi-hole

You are viewing proxied material from tilde.team. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.