The lists behind the DNS filter
With DNS filtering on, Vessel blocks risky sites using the lists and Quad9's verdicts. If you are not sure which to pick, choose the recommended Block malware, which is also the default.
Which to pick
No filtering
Blocks nothing, lookups do not go to Quad9, and the connection is still encrypted. Use it when you need to reach every site, or when another option blocks a site you need.
Block malwareRecommended
Blocks sites that spread malware, phishing and scams. This suits most people, and ordinary sites are usually unaffected.
Block malware, ads and trackers
Adds a larger list that blocks ads and trackers, and some more malware sites too. It occasionally breaks part of a site.
Both filtering options send lookups to Quad9 for a verdict. It sees the domain and the node's IP address, not yours. You choose the option when you create a device. To change it later, delete the device, create it again and import the new configuration file into the app. Your account is not affected.
When a site will not open
- Go to the DNS filtering page and look up the address. If the result names the option you chose when you created the device, Vessel blocked it. A blocked site only shows a site-not-found message, with no notice.
- If Vessel did not block it, the cause is probably the site or your current network. If it opens with the VPN off, the site may refuse VPN connections, or may have the node's location wrong. Tell us the address through Feedback.
- If you need it urgently you can turn the VPN off, but a site on a list may really be harmful, so check the address before you pay. For a lasting fix, go to My devices, delete the device, create it again, pick an option that blocks less, and import the new configuration file into the app.
- If you think it is a mistake, report it. For the 165 list (Taiwan police's anti-fraud hotline), call 165. For the Administration for Digital Industries list (part of Taiwan's Ministry of Digital Affairs), appeal to that agency. For other lists and Quad9, use Feedback.
Only the government can change its lists. If we confirm a mistake, Vessel can stop blocking the name on its own service and add it to the exclusion list. Vessel is run by volunteers and has no fixed response time.
Common questions
Does Vessel record which sites I look up?
No. Vessel's DNS keeps no record of lookups or of what it blocked. Filtering options send lookups to Quad9, which sees the domain and the node's IP address, not yours. The blocked count in your device list is only a number, and leaves out what Quad9 blocks. The node's configuration is public on GitHub.
What the VPN itself can see is explained in VPN basics.
Is it slower, or does it use more battery?
The lists are compared on Vessel's servers, so your phone or computer does no extra matching and battery use should not change noticeably. On 2026-11-07 we measured all three nodes: lookups sent to Quad9 were no slower than without a filter, and most took under 0.1 seconds. We have not formally measured the difference in overall browsing speed. While a list updates, lookups can pause for a few seconds to a few tens of seconds.
Will it block my bank, shopping sites or LINE?
Usually not, though we have not checked banks and shopping sites one by one. In November 2026 we checked popular sites in Taiwan, Japan, Hong Kong and Singapore, and no main site was blocked. The lists can still be wrong, and Block malware, ads and trackers can break part of a site.
Does it block ads inside apps?
Some of them. Ads from the same domain as the content are not blocked, such as ads inside YouTube videos. When an app or browser looks up sites its own way, the filter does not apply.
Can I unblock just one site?
Not at the moment. Every site on a device uses the same option.
The lists in use
The maintainers below decide which domains (site names, such as example.com) are on their lists. Vessel does not make its own lists.
Blocked with "Block malware" or "Block malware, ads and trackers"
Malware and phishing sites
Maintained by HaGeZi (community project)
List: HaGeZi Threat Intelligence Feeds (mini)
domains
Fake investment, fake shopping and other scam sites
Maintained by Taiwan's National Police Agency
List: 165 list of scam sites
domains
Fake shops reported by online retailers
Maintained by Taiwan's Administration for Digital Industries
List: Scam domain list
domains
Blocked only with "Block malware, ads and trackers"
Ads and tracking
Maintained by HaGeZi (community project)
List: HaGeZi Multi PRO
domains
Besides the lists, both filter options send lookups to Quad9 (a Swiss nonprofit foundation) for a verdict. It combines about 20 threat intelligence sources. Its list is not on Vessel's nodes, and you can look up a single domain on Quad9's lookup page.
Lists from the government
"Block malware" and "Block malware, ads and trackers" both include two lists from Taiwan's government. Only "No filtering" leaves them out.
The 165 list is requested by the police under the Fraud Crime Hazard Prevention Act, and the scam domain list comes from online retailers' reports. Taiwan's ISPs make these sites unreachable. On Vessel you would lose that protection, so we use the same lists.
We add the public data as it is, without checking each entry, so its mistakes come along too. We do not know the agencies' review and removal processes, and cannot say how long a mistake takes to fix. If you do not want these lists, choose No filtering. On 2026-11-07 we sampled 400 sites from the 165 list, and Chunghwa Telecom's HiNet blocked nearly all of them too.
So far, no government body has asked Vessel to add or remove a domain.
The rules for choosing lists
- Block security threats only. Ads and tracking are blocked only for people who choose that
- No content control. Gambling, adult and social sites, circumvention tools and dynamic DNS (services that give a home network a fixed address) are not reasons to add a domain. Where a list includes them anyway, they are under known problems
- We do not make our own block lists. We use only public lists and filtering services whose verdicts can be looked up, and report gaps to their maintainers
- A new list has to add what the current ones lack, be checked for wrong blocks first, and come with terms that allow this use
Vessel is run by volunteers of the anoni.net community, and its legal entity is still being settled. You can reach us at [email protected], or through feedback. Vessel's maintainers decide which lists to add or remove, and each change goes in the change log. The principles are still being finalized, and we already work by them.
What the filters can and cannot do
The table shows a sample check from November 2026: each number is the share of sampled sites that were blocked. The first two columns are Vessel's two filter options, Quad9 included, and with filtering off, Vessel blocks nothing. Cloudflare 1.1.1.2 is another common free filtering service. A range (such as 31–100%) means the result varied widely with who reported the sites (details under "For those who want more detail").
| Kind | Vessel Block malware | Vessel Block malware, ads and trackers | Cloudflare 1.1.1.2 |
|---|---|---|---|
| Phishing sites, when they first appear | 2–12% | 3–13% | 4–61% |
| Phishing sites, a day later | 31–100% | 32–100% | 71–86% |
| Sites spreading malware | 90% | 96% | 57% |
| Scam sites on Taiwan's government lists | 100% | 100% | 1–2% |
| Tracking built into phones and systems | 0% | 93% | 0% |
- Vessel is weakest on phishing: a day later it still blocks fewer of the sites reported by OpenPhish and phishunt.io than Cloudflare. When a site first appears, every service's share is low, except Cloudflare's 61% on sites reported by OpenPhish. Cloudflare also blocks archive.is and adult and gambling sites, which breaks our principles, so we did not choose it.
- Cloudflare blocks almost none of the scam sites on Taiwan's government lists, and both of Vessel's filters block them. The sample comes from those lists, so Vessel is 100% by definition.
- Cloudflare 1.1.1.2 does not offer ad and tracker blocking, so the 0% in the last row does not mean it is worse. Vessel's 93% also runs high, since the test data and Vessel's list both come from HaGeZi.
Protection beyond the lists
Lists add sites afterwards and DNS filtering only sees domains, so a new phishing site usually gets through. These three things do not wait for a list update.
- Keep your browser's built-in phishing protection on: Chrome, Edge, Firefox and Safari all have it, usually on by default. It judges by address, not just the domain, so it has a chance of catching fake sites on shared platforms, and it exchanges data with the browser maker's service to do so.
- Fill in passwords with a password manager: it only autofills on sites it has saved. If it does not autofill, check the address before you type anything.
- Use passkeys for important accounts: a passkey is bound to the site's domain, so it does not work on a fake site.
The filter is one more layer and does not replace your own judgment. Check the address before you enter a password or pay.
It does not replace antivirus software either. Other limits are on the DNS filtering.
Where VPNs are restricted, or if your situation is sensitive, read this question in the FAQ first.
For those who want more detail
The measurements in detail
The share of phishing sites blocked a day after they first appeared, by who reported them.
- Vessel
- Other services
- Phishing: from 2026-11-01 to 11-07 we recorded sites newly reported by Poland's CERT Polska, OpenPhish and phishunt.io every hour and checked them then and 24 hours later, counting only sites that still resolved to an IP address. The nodes did not forward to Quad9 yet, so Vessel's share combines the results of the lists and Quad9.
- The reporting sources also feed some of the lists and Quad9, and a service that uses a source scores higher on it. phishunt.io is less affected, but has only about a hundred sites.
- Malware: on 2026-11-07 we sampled 800 of malware-filter's URLhaus domains, counting only the 240 that still resolved to an IP address. Built-in tracking: measured on 2026-11-01, from HaGeZi's lists.
- Taiwan's scam sites: on 2026-11-07 we sampled 300 from each of the 165 list and the Administration for Digital Industries list, counting only sites that still resolved to an IP address (197 and 87, the second being a small sample).
- We used only public lists and public test data, not anyone's lookups. Every service's results change, and the numbers only describe the time of measurement.
What the lists are made of
- Unique
- Overlap
The lists overlap, so they add up to more than the total. Only domains no other list has show how much less would be blocked without a list.
Known problems
Checked on 2026-11-07 against Citizen Lab's public test lists of websites and the official sites of common tools.
- No site on the test lists was blocked in the five categories of human rights, news, politics, LGBT and tools for getting around blocking, nor the official sites of Tor, Psiphon, Proton, Mullvad and Lantern. Only the websites were checked. If a tool's own connection is affected, please tell us
- Both HaGeZi lists include a few gambling and adult sites. Of 67 gambling sites on the test list, 6 are on the ad and tracker list and 1 is on the malware list. We will finish checking by the end of 2026 and add those that break the principles to the exclusion list
- Both lists also include some VPN service sites and encrypted DNS servers, mostly on the ad and tracker list. We will finish checking these by the end of 2026 too
- The ads and tracking list blocks dweb.link, a public entry to IPFS, a kind of distributed storage. We have asked HaGeZi about it
- Quad9 can block ordinary sites too: 5 of the 3,418 sites on the test list. If it is a mistake, Vessel can allow the site on its own service
Domains left out
Domains that should not be blocked are in the public exclusion list, and stay unblocked even when a list has them. Only the listed name is left out, so other addresses under it can still be blocked.
| Domain | Why |
|---|---|
from-ia.com | A shared address for dynamic DNS: blocking it would block everyone who uses it |
gomlab.com | On the 165 list, but HiNet no longer blocked it when checked on 2026-11-07 |
playinfo.gomlab.com | On the 165 list, but HiNet no longer blocked it when checked on 2026-11-07 |
Change log
- 2026-11-07 Filtering options began sending lookups to Quad9, to catch phishing sites the lists miss
- 2026-11-07 Added the public exclusion list, starting with 3 domains
- 2026-11-01 Added the scam domain list
- 2026-11-01 Added the 165 list of scam sites
- 2026-10-31 The ads and tracking list moved from HaGeZi Multi Normal to Multi PRO, the level HaGeZi recommends
- 2026-10-27 The DNS filter started, with HaGeZi's Threat Intelligence Feeds (mini) and Multi Normal