From 5b1d4130e9b8cb138f8ef0ce72c6dce095e47545 Mon Sep 17 00:00:00 2001
From: Maciek <tomczukmaciej@gmail.com>
Date: Wed, 10 Jun 2026 14:18:02 +0200
Subject: [PATCH 01/15] feat(blocklists): add Security category, Hagezi NRD and
 new general lists

Signed-off-by: Maciek <tomczukmaciej@gmail.com>
---
 blocklists/README.md                          |  7 +-
 blocklists/internal/extractor/domains.go      | 33 +++++--
 blocklists/internal/extractor/domains_test.go | 59 ++++++++++++
 blocklists/internal/extractor/extractor.go    |  6 ++
 .../internal/extractor/extractor_test.go      | 18 ++++
 blocklists/service/testdata/real/README.md    |  2 +-
 blocklists/sources/3rd_party/1hosts.json      | 28 ++++++
 blocklists/sources/3rd_party/peter_lowe.json  | 15 +++
 .../sources/3rd_party/someonewhocares.json    | 15 +++
 blocklists/sources/security/nrd.json          | 92 +++++++++++++++++++
 blocklists/sources/security/tif.json          |  3 +-
 11 files changed, 264 insertions(+), 14 deletions(-)
 create mode 100644 blocklists/sources/3rd_party/1hosts.json
 create mode 100644 blocklists/sources/3rd_party/peter_lowe.json
 create mode 100644 blocklists/sources/3rd_party/someonewhocares.json
 create mode 100644 blocklists/sources/security/nrd.json

diff --git a/blocklists/README.md b/blocklists/README.md
index e891c82a..dd05349e 100644
--- a/blocklists/README.md
+++ b/blocklists/README.md
@@ -63,11 +63,12 @@ The **extractor is selected by the `blocklist_id` prefix**
 | `hagezi*` | Hagezi | plain domains, `#` headers (strict metadata) |
 | `oisd*` | OISD | plain domains (`domainswild2`), `#` headers |
 | `steven_black*` | Steven Black | hosts file (`0.0.0.0 domain`) |
-| `blp_*`, `ut1_*`, `shadowwhisperer_*` | Domains | plain domains, graceful metadata, hosts-tolerant |
+| `blp_*`, `ut1_*`, `shadowwhisperer_*`, `someonewhocares_*`, `peter_lowe*`, `1hosts_*` | Domains | plain or hosts-format domains, graceful metadata (optional `Last modified`/`Last updated`/`Count` headers), hosts-tolerant |
 
 Key source fields: `blocklist_id` (required, routes the extractor), `name`,
-`description`, `source_url`, `kind` (`general`/`category`/`security`),
-`category`, `intensity`, `default`, `schedule` (cron). See any file under
+`description`, `source_url`, `kind` (`general`/`category`),
+`category` (e.g. `gambling`, `security`), `intensity`, `default`,
+`schedule` (cron). See any file under
 `sources/` for a complete example.
 
 The authoritative behaviour spec is
diff --git a/blocklists/internal/extractor/domains.go b/blocklists/internal/extractor/domains.go
index e23c8548..3a04e751 100644
--- a/blocklists/internal/extractor/domains.go
+++ b/blocklists/internal/extractor/domains.go
@@ -11,9 +11,13 @@ import (
 )
 
 var (
-	// Common header patterns across plain domain list formats
-	domainsReLastModified = regexp.MustCompile(`(?i)^[#!]\s*Last modified:\s*(.+)`)
+	// Common header patterns across plain domain list formats. These tolerate the
+	// variations seen across providers: "Last modified" (Block List Project) and
+	// "Last updated" (Dan Pollock / Peter Lowe); "Entries"/"Number of Entries"
+	// (yoyo) and "Count: N rules" with a decorative prefix (1Hosts).
+	domainsReLastModified = regexp.MustCompile(`(?i)^[#!]\s*Last (?:modified|updated):\s*(.+)`)
 	domainsReEntries      = regexp.MustCompile(`(?i)^[#!]\s*(?:Number of )?Entries:\s*([\d,]+)`)
+	domainsReCount        = regexp.MustCompile(`(?i)^[#!].*\bCount:\s*([\d,]+)`)
 )
 
 // DomainsExtractor implements the Extractor interface for plain domain-per-line
@@ -88,11 +92,17 @@ func (e *DomainsExtractor) ExtractMetadata(blocklistBytes []byte) (time.Time, st
 			}
 		}
 
-		if matches := domainsReEntries.FindStringSubmatch(line); matches != nil && !foundEntries {
-			cleaned := strings.ReplaceAll(matches[1], ",", "")
-			if n, err := strconv.Atoi(cleaned); err == nil {
-				numEntries = n
-				foundEntries = true
+		if !foundEntries {
+			matches := domainsReEntries.FindStringSubmatch(line)
+			if matches == nil {
+				matches = domainsReCount.FindStringSubmatch(line)
+			}
+			if matches != nil {
+				cleaned := strings.ReplaceAll(matches[1], ",", "")
+				if n, err := strconv.Atoi(cleaned); err == nil {
+					numEntries = n
+					foundEntries = true
+				}
 			}
 		}
 
@@ -124,7 +134,9 @@ func (e *DomainsExtractor) ProcessLine(line string) (string, error) {
 	return stripHostsIP(line), nil
 }
 
-// parseFlexibleDate tries multiple date formats commonly found in blocklist headers
+// parseFlexibleDate tries multiple date formats commonly found in blocklist
+// headers. Parsed values are normalized to UTC so callers can compare instants
+// without location-pointer differences (e.g. a "GMT" zone vs time.UTC).
 func parseFlexibleDate(s string) (time.Time, bool) {
 	formats := []string{
 		"2006-01-02 15:04:05 MST",
@@ -135,10 +147,13 @@ func parseFlexibleDate(s string) (time.Time, bool) {
 		"02 Jan 2006",
 		"Jan 02, 2006",
 		time.RFC3339,
+		time.RFC3339Nano,                   // 1Hosts: 2026-06-09T10:59:53.132Z
+		time.RFC1123,                       // Peter Lowe/yoyo: Tue, 09 Jun 2026 14:53:58 GMT
+		"Mon, 02 Jan 2006 at 15:04:05 MST", // someonewhocares: Wed, 10 Jun 2026 at 00:35:57 GMT
 	}
 	for _, fmt := range formats {
 		if t, err := time.Parse(fmt, s); err == nil {
-			return t, true
+			return t.UTC(), true
 		}
 	}
 	return time.Time{}, false
diff --git a/blocklists/internal/extractor/domains_test.go b/blocklists/internal/extractor/domains_test.go
index 4f9cae32..3a4ff4fa 100644
--- a/blocklists/internal/extractor/domains_test.go
+++ b/blocklists/internal/extractor/domains_test.go
@@ -149,6 +149,44 @@ domain3.com`,
 			wantNumEntries:   3,
 			wantErr:          false,
 		},
+		{
+			// specRef: #C11 — someonewhocares "Last updated: <day>, <date> at <time> GMT".
+			name: "someonewhocares 'Last updated ... at ... GMT'",
+			input: `# This hosts file is brought to you by Dan Pollock
+# Last updated: Wed, 10 Jun 2026 at 00:35:57 GMT
+0.0.0.0 ads234.com
+0.0.0.0 media.fastclick.net`,
+			wantLastModified: time.Date(2026, 6, 10, 0, 35, 57, 0, time.UTC),
+			wantVersion:      "",
+			wantNumEntries:   2,
+			wantErr:          false,
+		},
+		{
+			// specRef: #C11 — Peter Lowe/yoyo lowercase "last updated" (RFC1123) + "entries".
+			name: "peter lowe 'last updated' RFC1123 with entries count",
+			input: `# Blocklist for use with hosts files
+# last updated:   Tue, 09 Jun 2026 14:53:58 GMT
+# entries:        3509
+127.0.0.1 101com.com
+127.0.0.1 180hits.de`,
+			wantLastModified: time.Date(2026, 6, 9, 14, 53, 58, 0, time.UTC),
+			wantVersion:      "",
+			wantNumEntries:   3509,
+			wantErr:          false,
+		},
+		{
+			// specRef: #C11 — 1Hosts fractional-second ISO date + "|Count: N rules!".
+			name: "1hosts RFC3339Nano date and '|Count: N rules' line",
+			input: `# Title: 1Hosts (Lite)
+# Last modified: 2026-06-09T10:59:53.132Z
+#  |Count: 197,654 rules!
+00000.uno
+000nethost.com`,
+			wantLastModified: time.Date(2026, 6, 9, 10, 59, 53, 132000000, time.UTC),
+			wantVersion:      "",
+			wantNumEntries:   197654,
+			wantErr:          false,
+		},
 	}
 
 	extractor := NewDomainsExtractor()
@@ -266,6 +304,27 @@ func TestParseFlexibleDate(t *testing.T) {
 			want:  time.Date(2024, 1, 15, 10, 30, 0, 0, time.UTC),
 			ok:    true,
 		},
+		{
+			// specRef: #C11 — RFC1123 GMT normalized to UTC (Peter Lowe/yoyo).
+			name:  "RFC1123 GMT",
+			input: "Tue, 09 Jun 2026 14:53:58 GMT",
+			want:  time.Date(2026, 6, 9, 14, 53, 58, 0, time.UTC),
+			ok:    true,
+		},
+		{
+			// specRef: #C11 — someonewhocares "... at ... GMT" format.
+			name:  "day month year 'at' time GMT",
+			input: "Wed, 10 Jun 2026 at 00:35:57 GMT",
+			want:  time.Date(2026, 6, 10, 0, 35, 57, 0, time.UTC),
+			ok:    true,
+		},
+		{
+			// specRef: #C11 — 1Hosts fractional-second ISO 8601.
+			name:  "RFC3339 with fractional seconds",
+			input: "2026-06-09T10:59:53.132Z",
+			want:  time.Date(2026, 6, 9, 10, 59, 53, 132000000, time.UTC),
+			ok:    true,
+		},
 		{
 			name:  "unparseable",
 			input: "not a date",
diff --git a/blocklists/internal/extractor/extractor.go b/blocklists/internal/extractor/extractor.go
index 0139917f..efbf7abc 100644
--- a/blocklists/internal/extractor/extractor.go
+++ b/blocklists/internal/extractor/extractor.go
@@ -39,6 +39,12 @@ func NewExtractor(blocklistID string) (Extractor, error) {
 		return NewDomainsExtractor(), nil
 	case strings.HasPrefix(blocklistID, "shadowwhisperer_"):
 		return NewDomainsExtractor(), nil
+	case strings.HasPrefix(blocklistID, "someonewhocares_"):
+		return NewDomainsExtractor(), nil
+	case strings.HasPrefix(blocklistID, "peter_lowe"):
+		return NewDomainsExtractor(), nil
+	case strings.HasPrefix(blocklistID, "1hosts_"):
+		return NewDomainsExtractor(), nil
 	default:
 		log.Error().Msg("Unknown blocklist ID")
 		return nil, fmt.Errorf("unknown blocklist ID: %s", blocklistID)
diff --git a/blocklists/internal/extractor/extractor_test.go b/blocklists/internal/extractor/extractor_test.go
index 92039a88..6945400c 100644
--- a/blocklists/internal/extractor/extractor_test.go
+++ b/blocklists/internal/extractor/extractor_test.go
@@ -61,6 +61,24 @@ func TestNewExtractor(t *testing.T) {
 			wantType:    "*extractor.DomainsExtractor",
 			wantErr:     false,
 		},
+		{
+			name:        "someonewhocares extractor",
+			blocklistID: "someonewhocares_hosts",
+			wantType:    "*extractor.DomainsExtractor",
+			wantErr:     false,
+		},
+		{
+			name:        "peter_lowe extractor",
+			blocklistID: "peter_lowe_adservers",
+			wantType:    "*extractor.DomainsExtractor",
+			wantErr:     false,
+		},
+		{
+			name:        "1hosts extractor",
+			blocklistID: "1hosts_lite",
+			wantType:    "*extractor.DomainsExtractor",
+			wantErr:     false,
+		},
 		{
 			name:        "unknown extractor",
 			blocklistID: "unknown_type",
diff --git a/blocklists/service/testdata/real/README.md b/blocklists/service/testdata/real/README.md
index ed9b51fb..20c84f48 100644
--- a/blocklists/service/testdata/real/README.md
+++ b/blocklists/service/testdata/real/README.md
@@ -28,7 +28,7 @@ its own license (see the source repos).
 | blp_fakenews.txt | blp_fakenews | Domains | https://github.com/marktron/fakenews (hosts format) |
 | ut1.txt | ut1_gaming | Domains | https://github.com/olbat/ut1-blacklists (games/domains) |
 | shadowwhisperer.txt | shadowwhisperer_dating | Domains | https://github.com/ShadowWhisperer/BlockLists (RAW/Dating) |
-| hagezi_tif.txt | hagezi_threat_intelligence_feeds_full | Hagezi | https://github.com/hagezi/dns-blocklists (domains/tif.txt, security) |
+| hagezi_tif.txt | hagezi_threat_intelligence_feeds_full | Hagezi | https://github.com/hagezi/dns-blocklists (domains/tif.txt, security category) |
 | hagezi_nsfw.txt | hagezi_nsfw | Hagezi | https://github.com/hagezi/dns-blocklists (wildcard/nsfw-onlydomains.txt) |
 | blp_drugs.txt | blp_drugs | Domains | https://github.com/blocklistproject/Lists (alt-version/drugs-nl.txt) |
 | ut1_dating.txt | ut1_dating | Domains | https://github.com/olbat/ut1-blacklists (dating/domains) |
diff --git a/blocklists/sources/3rd_party/1hosts.json b/blocklists/sources/3rd_party/1hosts.json
new file mode 100644
index 00000000..4e3d4de4
--- /dev/null
+++ b/blocklists/sources/3rd_party/1hosts.json
@@ -0,0 +1,28 @@
+[
+  {
+    "blocklist_id": "1hosts_lite",
+    "name": "1Hosts (Lite)",
+    "description": "1Hosts Lite — a balanced, low-false-positive blocklist for ads, trackers and malware. Recommended for general use.",
+    "source_url": "https://raw.githubusercontent.com/badmojr/1Hosts/master/Lite/domains.wildcards",
+    "homepage": "https://github.com/badmojr/1Hosts",
+    "syntax": "domains",
+    "kind": "general",
+    "intensity": ["basic"],
+    "tags": ["1hosts", "basic"],
+    "schedule": "0 8 * * *",
+    "default": false
+  },
+  {
+    "blocklist_id": "1hosts_xtra",
+    "name": "1Hosts (Xtra)",
+    "description": "1Hosts Xtra — an aggressive blocklist for maximum threat mitigation. Expect a higher false-positive rate; whitelist critical services as needed.",
+    "source_url": "https://raw.githubusercontent.com/badmojr/1Hosts/master/Xtra/domains.wildcards",
+    "homepage": "https://github.com/badmojr/1Hosts",
+    "syntax": "domains",
+    "kind": "general",
+    "intensity": ["restrictive"],
+    "tags": ["1hosts", "restrictive"],
+    "schedule": "15 8 * * *",
+    "default": false
+  }
+]
diff --git a/blocklists/sources/3rd_party/peter_lowe.json b/blocklists/sources/3rd_party/peter_lowe.json
new file mode 100644
index 00000000..66ebe0d8
--- /dev/null
+++ b/blocklists/sources/3rd_party/peter_lowe.json
@@ -0,0 +1,15 @@
+[
+  {
+    "blocklist_id": "peter_lowe_adservers",
+    "name": "Peter Lowe's Ad and tracking servers",
+    "description": "A curated, conservative list of ad and tracking server domains maintained by Peter Lowe (pgl.yoyo.org). Low false-positive rate.",
+    "source_url": "https://pgl.yoyo.org/adservers/serverlist.php?showintro=0;hostformat=hosts",
+    "homepage": "https://pgl.yoyo.org/adservers/",
+    "syntax": "hosts",
+    "kind": "general",
+    "intensity": ["basic"],
+    "tags": ["peter_lowe", "basic"],
+    "schedule": "0 7 * * *",
+    "default": false
+  }
+]
diff --git a/blocklists/sources/3rd_party/someonewhocares.json b/blocklists/sources/3rd_party/someonewhocares.json
new file mode 100644
index 00000000..23f40829
--- /dev/null
+++ b/blocklists/sources/3rd_party/someonewhocares.json
@@ -0,0 +1,15 @@
+[
+  {
+    "blocklist_id": "someonewhocares_hosts",
+    "name": "Dan Pollock's hosts",
+    "description": "A comprehensive, frequently-updated hosts list by Dan Pollock blocking ads, trackers, malware and other unwanted content.",
+    "source_url": "https://someonewhocares.org/hosts/zero/hosts",
+    "homepage": "https://someonewhocares.org/hosts/",
+    "syntax": "hosts",
+    "kind": "general",
+    "intensity": [],
+    "tags": ["someonewhocares"],
+    "schedule": "0 6 * * *",
+    "default": false
+  }
+]
diff --git a/blocklists/sources/security/nrd.json b/blocklists/sources/security/nrd.json
new file mode 100644
index 00000000..b5c76534
--- /dev/null
+++ b/blocklists/sources/security/nrd.json
@@ -0,0 +1,92 @@
+[
+  {
+    "blocklist_id": "hagezi_nrd_07",
+    "name": "Hagezi NRD — last 7 days",
+    "description": "Blocks newly registered domains (registered in the last 7 days). Newly registered domains are frequently abused for phishing, malware and scam campaigns. Aggressive — legitimate sites also register new domains, so expect false positives and whitelist critical services as needed.",
+    "source_url": "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/domains/nrd7.txt",
+    "homepage": "https://github.com/hagezi/dns-blocklists",
+    "syntax": "domains",
+    "kind": "category",
+    "category": "security",
+    "tags": [
+      "category",
+      "security",
+      "hagezi",
+      "nrd"
+    ],
+    "schedule": "@hourly",
+    "default": false
+  },
+  {
+    "blocklist_id": "hagezi_nrd_14_08",
+    "name": "Hagezi NRD — 8 to 14 days",
+    "description": "Blocks domains registered 8 to 14 days ago. Combine with the shorter window for broader newly-registered-domain coverage. Aggressive — expect false positives and whitelist critical services as needed.",
+    "source_url": "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/domains/nrd14-8.txt",
+    "homepage": "https://github.com/hagezi/dns-blocklists",
+    "syntax": "domains",
+    "kind": "category",
+    "category": "security",
+    "tags": [
+      "category",
+      "security",
+      "hagezi",
+      "nrd"
+    ],
+    "schedule": "@hourly",
+    "default": false
+  },
+  {
+    "blocklist_id": "hagezi_nrd_21_15",
+    "name": "Hagezi NRD — 15 to 21 days",
+    "description": "Blocks domains registered 15 to 21 days ago. Combine with the shorter windows for broader newly-registered-domain coverage. Aggressive — expect false positives and whitelist critical services as needed.",
+    "source_url": "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/domains/nrd21-15.txt",
+    "homepage": "https://github.com/hagezi/dns-blocklists",
+    "syntax": "domains",
+    "kind": "category",
+    "category": "security",
+    "tags": [
+      "category",
+      "security",
+      "hagezi",
+      "nrd"
+    ],
+    "schedule": "@hourly",
+    "default": false
+  },
+  {
+    "blocklist_id": "hagezi_nrd_28_22",
+    "name": "Hagezi NRD — 22 to 28 days",
+    "description": "Blocks domains registered 22 to 28 days ago. Combine with the shorter windows for broader newly-registered-domain coverage. Aggressive — expect false positives and whitelist critical services as needed.",
+    "source_url": "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/domains/nrd28-22.txt",
+    "homepage": "https://github.com/hagezi/dns-blocklists",
+    "syntax": "domains",
+    "kind": "category",
+    "category": "security",
+    "tags": [
+      "category",
+      "security",
+      "hagezi",
+      "nrd"
+    ],
+    "schedule": "@hourly",
+    "default": false
+  },
+  {
+    "blocklist_id": "hagezi_nrd_35_29",
+    "name": "Hagezi NRD — 29 to 35 days",
+    "description": "Blocks domains registered 29 to 35 days ago. Combine with the shorter windows for the widest newly-registered-domain coverage. Aggressive — expect false positives and whitelist critical services as needed.",
+    "source_url": "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/domains/nrd35-29.txt",
+    "homepage": "https://github.com/hagezi/dns-blocklists",
+    "syntax": "domains",
+    "kind": "category",
+    "category": "security",
+    "tags": [
+      "category",
+      "security",
+      "hagezi",
+      "nrd"
+    ],
+    "schedule": "@hourly",
+    "default": false
+  }
+]
\ No newline at end of file
diff --git a/blocklists/sources/security/tif.json b/blocklists/sources/security/tif.json
index 3c3c6c1c..c17a9eb9 100644
--- a/blocklists/sources/security/tif.json
+++ b/blocklists/sources/security/tif.json
@@ -6,7 +6,8 @@
     "source_url": "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/domains/tif.txt",
     "homepage": "https://github.com/hagezi/dns-blocklists",
     "syntax": "domains",
-    "kind": "security",
+    "kind": "category",
+    "category": "security",
     "intensity": ["comprehensive", "restrictive"],
     "tags": ["comprehensive"],
     "schedule": "@hourly",

From c1194b42efe0e024c6b0e4242f2d0572f6da714a Mon Sep 17 00:00:00 2001
From: Maciek <tomczukmaciej@gmail.com>
Date: Wed, 10 Jun 2026 14:22:51 +0200
Subject: [PATCH 02/15] feat(app): show Security category with NRD
 range-control card

Signed-off-by: Maciek <tomczukmaciej@gmail.com>
---
 app/src/__tests__/unit/NrdGroup.test.ts       |  61 +++++++
 .../blocklists/CategoriesContentSection.tsx   |  84 ++++++---
 .../pages/blocklists/MainContentSection.tsx   |  39 ++++
 app/src/pages/blocklists/NrdRangeCard.tsx     | 171 ++++++++++++++++++
 app/src/pages/blocklists/nrdGroup.ts          |  82 +++++++++
 5 files changed, 410 insertions(+), 27 deletions(-)
 create mode 100644 app/src/__tests__/unit/NrdGroup.test.ts
 create mode 100644 app/src/pages/blocklists/NrdRangeCard.tsx
 create mode 100644 app/src/pages/blocklists/nrdGroup.ts

diff --git a/app/src/__tests__/unit/NrdGroup.test.ts b/app/src/__tests__/unit/NrdGroup.test.ts
new file mode 100644
index 00000000..738b255c
--- /dev/null
+++ b/app/src/__tests__/unit/NrdGroup.test.ts
@@ -0,0 +1,61 @@
+import { describe, it, expect } from "vitest";
+import {
+    NRD_GROUP,
+    nrdDepthFromEnabled,
+    nrdDepthTargets,
+    orderedNrdItems,
+    isNrdItem,
+} from "@/pages/blocklists/nrdGroup";
+import type { ModelBlocklist } from "@/api/client/api";
+
+const ids = NRD_GROUP.map((t) => t.id);
+
+function bl(id: string, tags: string[] = []): ModelBlocklist {
+    return { blocklist_id: id, tags } as unknown as ModelBlocklist;
+}
+
+describe("nrdGroup depth math", () => {
+    it("reports depth 0 when nothing is enabled", () => {
+        expect(nrdDepthFromEnabled(ids, [])).toBe(0);
+    });
+
+    it("reports the cumulative depth for the lowest contiguous tiers", () => {
+        expect(nrdDepthFromEnabled(ids, [ids[0]])).toBe(1);
+        expect(nrdDepthFromEnabled(ids, [ids[0], ids[1]])).toBe(2);
+        expect(nrdDepthFromEnabled(ids, ids)).toBe(5);
+    });
+
+    it("uses the highest enabled tier when the selection is gapped", () => {
+        expect(nrdDepthFromEnabled(ids, [ids[0], ids[2]])).toBe(3);
+    });
+
+    it("maps a target depth to cumulative enable/disable sets", () => {
+        expect(nrdDepthTargets(ids, 0)).toEqual({ enable: [], disable: ids });
+        expect(nrdDepthTargets(ids, 2)).toEqual({
+            enable: [ids[0], ids[1]],
+            disable: [ids[2], ids[3], ids[4]],
+        });
+        expect(nrdDepthTargets(ids, 5)).toEqual({ enable: ids, disable: [] });
+    });
+
+    it("clamps out-of-range depths", () => {
+        expect(nrdDepthTargets(ids, 99).enable).toEqual(ids);
+        expect(nrdDepthTargets(ids, -3).enable).toEqual([]);
+    });
+});
+
+describe("nrdGroup item selection", () => {
+    it("identifies NRD items by known id or nrd tag", () => {
+        expect(isNrdItem(bl(ids[0]))).toBe(true);
+        expect(isNrdItem(bl("something_else", ["nrd"]))).toBe(true);
+        expect(isNrdItem(bl("hagezi_threat_intelligence_feeds_full"))).toBe(false);
+    });
+
+    it("orders present NRD items shortest→longest and skips missing tiers", () => {
+        const items = [bl(ids[2]), bl(ids[0]), bl("tif")];
+        expect(orderedNrdItems(items).map((b) => b.blocklist_id)).toEqual([
+            ids[0],
+            ids[2],
+        ]);
+    });
+});
diff --git a/app/src/pages/blocklists/CategoriesContentSection.tsx b/app/src/pages/blocklists/CategoriesContentSection.tsx
index b95c3df1..4a7d7da0 100644
--- a/app/src/pages/blocklists/CategoriesContentSection.tsx
+++ b/app/src/pages/blocklists/CategoriesContentSection.tsx
@@ -1,6 +1,8 @@
 import { type JSX, type LucideIcon, useMemo, useState, useRef, useEffect, useCallback } from "react";
 import BlocklistCard from "./BlocklistCard";
 import CategoryCard from "./CategoryCard";
+import NrdRangeCard from "./NrdRangeCard";
+import { isNrdItem, orderedNrdItems } from "./nrdGroup";
 import { ScrollArea } from "@/components/ui/scroll-area";
 import { Skeleton } from "@/components/ui/skeleton";
 import type { ModelBlocklist } from "@/api/client/api";
@@ -8,6 +10,7 @@ import { formatUpdatedRelative } from "./MainContentSection";
 import {
     Dices,
     ShieldAlert,
+    ShieldCheck,
     Heart,
     Pill,
     Users,
@@ -23,6 +26,7 @@ import {
 // Categories are derived from the API data — only categories present in the data are shown.
 // New categories added to the backend appear automatically; add an entry here for a custom icon/label.
 const CATEGORY_META: Record<string, { label: string; icon: LucideIcon; description: string }> = {
+    security: { label: "Security", icon: ShieldCheck, description: "Block malware, phishing, scam and threat-intelligence domains" },
     gambling: { label: "Gambling", icon: Dices, description: "Block online casinos, betting platforms, and lottery services" },
     adult: { label: "Adult Content", icon: ShieldAlert, description: "Block adult and explicit content websites" },
     dating: { label: "Dating", icon: Heart, description: "Block dating apps and matchmaking services" },
@@ -137,6 +141,8 @@ interface CategoriesContentSectionProps {
     enabledBlocklists: string[];
     onToggle: (id: string, checked: boolean) => void;
     onCategoryToggle: (blocklistIds: string[], enable: boolean) => void;
+    /** Apply an exact target set (enable some ids, disable others) in one action. */
+    onApplySet: (enableIds: string[], disableIds: string[]) => void;
     updating: string | null;
     loading: boolean;
     restricted?: boolean;
@@ -158,6 +164,7 @@ export default function CategoriesContentSection({
     enabledBlocklists,
     onToggle,
     onCategoryToggle,
+    onApplySet,
     updating,
     loading,
     restricted = false,
@@ -198,12 +205,15 @@ export default function CategoriesContentSection({
     }, [grouped, enabledBlocklists]);
 
     const handleCategoryToggle = (categoryKey: string) => {
-        const items = grouped.get(categoryKey) ?? [];
+        // NRD lists are driven by their own range card, not the category master
+        // toggle — exclude them so a single click never enables every NRD window.
+        const items = (grouped.get(categoryKey) ?? []).filter((bl) => !isNrdItem(bl));
         const allIds = items.map((bl) => bl.blocklist_id);
         const enabledCount = items.filter((bl) =>
             enabledBlocklists.includes(bl.blocklist_id)
         ).length;
 
+        if (allIds.length === 0) return;
         if (enabledCount > 0) {
             onCategoryToggle(allIds, false);
         } else {
@@ -272,6 +282,7 @@ export default function CategoriesContentSection({
                                 setExpandedCategory(expandedCategory === key ? null : key)
                             }
                             onBlocklistToggle={onToggle}
+                            onApplySet={onApplySet}
                             restricted={restricted}
                         />
                     )}
@@ -323,6 +334,7 @@ interface CategoriesGridProps {
     onCategoryToggle: (key: string) => void;
     onExpandToggle: (key: string) => void;
     onBlocklistToggle: (id: string, checked: boolean) => void;
+    onApplySet: (enableIds: string[], disableIds: string[]) => void;
     restricted?: boolean;
 }
 
@@ -335,6 +347,7 @@ function CategoriesGrid({
     onCategoryToggle,
     onExpandToggle,
     onBlocklistToggle,
+    onApplySet,
     restricted = false,
 }: CategoriesGridProps) {
     return (
@@ -357,32 +370,49 @@ function CategoriesGrid({
                             onExpandToggle={() => onExpandToggle(cat.key)}
                         />
 
-                        {isExpanded && expandedData && (
-                            <div className="col-[1/-1]">
-                                <ExpandPanel
-                                    expanded
-                                    categoryLabel={expandedData.label}
-                                    categoryIcon={expandedData.icon}
-                                >
-                                    {expandedData.items.map((bl) => {
-                                        const isEnabled = enabledBlocklists.includes(bl.blocklist_id);
-                                        return (
-                                            <BlocklistCard
-                                                key={bl.blocklist_id}
-                                                title={bl.name}
-                                                description={bl.description}
-                                                entries={bl.entries}
-                                                updated={formatUpdatedRelative(bl.last_modified)}
-                                                onSwitchChange={(checked) => onBlocklistToggle(bl.blocklist_id, checked)}
-                                                switchChecked={isEnabled}
-                                                switchDisabled={updating === bl.blocklist_id || restricted}
-                                                homepage={bl.homepage}
-                                            />
-                                        );
-                                    })}
-                                </ExpandPanel>
-                            </div>
-                        )}
+                        {isExpanded && expandedData && (() => {
+                            // NRD lists collapse into a single range card; everything
+                            // else renders as an individual toggle card.
+                            const nrdItems = orderedNrdItems(expandedData.items);
+                            const regularItems = expandedData.items.filter((bl) => !isNrdItem(bl));
+                            return (
+                                <div className="col-[1/-1]">
+                                    <ExpandPanel
+                                        expanded
+                                        categoryLabel={expandedData.label}
+                                        categoryIcon={expandedData.icon}
+                                    >
+                                        {nrdItems.length > 0 && (
+                                            <div className="col-span-1 sm:col-span-2 md:col-span-3 xl:col-span-4">
+                                                <NrdRangeCard
+                                                    items={nrdItems}
+                                                    enabledBlocklists={enabledBlocklists}
+                                                    onApplySet={onApplySet}
+                                                    updating={updating}
+                                                    restricted={restricted}
+                                                />
+                                            </div>
+                                        )}
+                                        {regularItems.map((bl) => {
+                                            const isEnabled = enabledBlocklists.includes(bl.blocklist_id);
+                                            return (
+                                                <BlocklistCard
+                                                    key={bl.blocklist_id}
+                                                    title={bl.name}
+                                                    description={bl.description}
+                                                    entries={bl.entries}
+                                                    updated={formatUpdatedRelative(bl.last_modified)}
+                                                    onSwitchChange={(checked) => onBlocklistToggle(bl.blocklist_id, checked)}
+                                                    switchChecked={isEnabled}
+                                                    switchDisabled={updating === bl.blocklist_id || restricted}
+                                                    homepage={bl.homepage}
+                                                />
+                                            );
+                                        })}
+                                    </ExpandPanel>
+                                </div>
+                            );
+                        })()}
                     </div>
                 );
             })}
diff --git a/app/src/pages/blocklists/MainContentSection.tsx b/app/src/pages/blocklists/MainContentSection.tsx
index 03948eed..b2516448 100644
--- a/app/src/pages/blocklists/MainContentSection.tsx
+++ b/app/src/pages/blocklists/MainContentSection.tsx
@@ -41,6 +41,9 @@ const INDIVIDUAL_LISTS = [
     { label: "Adguard", tag: "adguard" },
     { label: "OISD", tag: "oisd" },
     { label: "Steven Black", tag: "steven_black" },
+    { label: "1Hosts", tag: "1hosts" },
+    { label: "Peter Lowe", tag: "peter_lowe" },
+    { label: "Dan Pollock", tag: "someonewhocares" },
 ];
 
 const PREDEFINED_LISTS = [
@@ -168,6 +171,41 @@ export default function MainContentSection(): JSX.Element {
         }
     };
 
+    // Handler to apply an exact target set in one action: enable some blocklists
+    // and disable others (used by the NRD range card to move between depths).
+    const handleApplyBlocklistSet = async (enableIds: string[], disableIds: string[]) => {
+        if (!activeProfile?.profile_id) return;
+        const toEnable = enableIds.filter((id) => !enabledBlocklists.includes(id));
+        const toDisable = disableIds.filter((id) => enabledBlocklists.includes(id));
+        if (toEnable.length === 0 && toDisable.length === 0) return;
+        setUpdating("nrd");
+        try {
+            if (toEnable.length > 0) {
+                await api.Client.profilesApi.apiV1ProfilesIdBlocklistsPost(
+                    activeProfile.profile_id,
+                    { blocklist_ids: toEnable } as ApiBlocklistsUpdates
+                );
+            }
+            if (toDisable.length > 0) {
+                await api.Client.profilesApi.apiV1ProfilesIdBlocklistsDelete(
+                    activeProfile.profile_id,
+                    { blocklist_ids: toDisable } as ApiBlocklistsUpdates
+                );
+            }
+            const updatedProfile = await api.Client.profilesApi.apiV1ProfilesIdGet(activeProfile.profile_id);
+            setActiveProfile(updatedProfile.data);
+            toast.success("Blocklists updated", {
+                description: "Your selection has been updated successfully.",
+            });
+        } catch {
+            toast.error("Error", {
+                description: "Failed to update blocklists. Please try again.",
+            });
+        } finally {
+            setUpdating(null);
+        }
+    };
+
     // Handler to enable/disable a blocklist for the user
     const handleBlocklistSwitch = async (blocklistId: string, checked: boolean) => {
         if (!activeProfile?.profile_id) return;
@@ -549,6 +587,7 @@ export default function MainContentSection(): JSX.Element {
                             enabledBlocklists={enabledBlocklists}
                             onToggle={handleBlocklistSwitch}
                             onCategoryToggle={handleCategoryToggle}
+                            onApplySet={handleApplyBlocklistSet}
                             updating={updating}
                             loading={loading}
                             restricted={isRestricted}
diff --git a/app/src/pages/blocklists/NrdRangeCard.tsx b/app/src/pages/blocklists/NrdRangeCard.tsx
new file mode 100644
index 00000000..4a7d31a4
--- /dev/null
+++ b/app/src/pages/blocklists/NrdRangeCard.tsx
@@ -0,0 +1,171 @@
+import { type JSX, useMemo } from "react";
+import { Card, CardContent } from "@/components/ui/card";
+import { Button } from "@/components/ui/button";
+import { ToggleGroup, ToggleGroupItem } from "@/components/ui/toggle-group";
+import { Tooltip } from "@/components/ui/tooltip";
+import { ExternalLinkIcon } from "lucide-react";
+import type { ModelBlocklist } from "@/api/client/api";
+import { formatUpdatedRelative } from "./MainContentSection";
+import {
+    NRD_GROUP,
+    nrdDepthFromEnabled,
+    nrdDepthTargets,
+} from "./nrdGroup";
+
+interface NrdRangeCardProps {
+    /** NRD blocklists present, ordered shortest→longest window. */
+    items: ModelBlocklist[];
+    enabledBlocklists: string[];
+    /** Apply an exact target: enable some ids, disable others, in one action. */
+    onApplySet: (enableIds: string[], disableIds: string[]) => void;
+    updating: string | null;
+    restricted?: boolean;
+}
+
+function formatEntries(n: number): string {
+    if (n >= 1_000_000) return `${(n / 1_000_000).toFixed(1)}M`;
+    if (n >= 1_000) return `${(n / 1_000).toFixed(0)}K`;
+    return String(n);
+}
+
+/**
+ * Single card representing the Hagezi NRD list family as a stepped
+ * registration-recency range (Off · 7d · … · 35d). Each step cumulatively
+ * enables the corresponding windows; the depth math lives in `nrdGroup.ts`.
+ */
+export default function NrdRangeCard({
+    items,
+    enabledBlocklists,
+    onApplySet,
+    updating,
+    restricted = false,
+}: NrdRangeCardProps): JSX.Element {
+    const orderedIds = useMemo(() => items.map((bl) => bl.blocklist_id), [items]);
+    const labelById = useMemo(
+        () => new Map(NRD_GROUP.map((t) => [t.id, t.label])),
+        [],
+    );
+
+    const depth = nrdDepthFromEnabled(orderedIds, enabledBlocklists);
+    const disabled = updating !== null || restricted;
+
+    // Aggregate entries and freshness for the currently selected depth.
+    const selected = items.slice(0, depth);
+    const selectedEntries = selected.reduce(
+        (sum, bl) => sum + (typeof bl.entries === "number" ? bl.entries : 0),
+        0,
+    );
+    const mostRecent = selected.reduce((latest, bl) => {
+        if (!bl.last_modified) return latest;
+        if (!latest) return bl.last_modified;
+        return new Date(bl.last_modified) > new Date(latest)
+            ? bl.last_modified
+            : latest;
+    }, "" as string);
+
+    const homepage = items[0]?.homepage;
+
+    const handleChange = (value: string) => {
+        // Radix single toggle yields "" when the active item is re-pressed; ignore
+        // (the explicit "Off" step is the way to disable everything).
+        if (value === "") return;
+        const next = Number(value);
+        if (Number.isNaN(next) || next === depth) return;
+        const { enable, disable } = nrdDepthTargets(orderedIds, next);
+        onApplySet(enable, disable);
+    };
+
+    return (
+        <Card
+            data-testid="nrd-range-card"
+            className="bg-transparent dark:bg-[var(--variable-collection-surface)] p-3 border border-[var(--tailwind-colors-slate-light-300)] dark:border-transparent rounded-[var(--tailwind-primitives-border-radius-rounded)] shadow-sm flex flex-col gap-3 w-full overflow-hidden"
+        >
+            <CardContent className="p-0 flex flex-col gap-3">
+                <div className="flex items-start justify-between gap-2">
+                    <div className="min-w-0">
+                        <div
+                            className="text-tailwind-colors-slate-50 font-semibold text-base leading-tight truncate"
+                            title="Newly Registered Domains (NRD)"
+                        >
+                            Newly Registered Domains (NRD)
+                        </div>
+                        <div className="pt-1 text-xs text-[var(--tailwind-colors-slate-100)] break-words">
+                            Block recently registered domains, often abused for
+                            phishing, malware and scams. Choose how far back to
+                            block by registration date.{" "}
+                            <span className="text-[var(--tailwind-colors-amber-400,#fbbf24)]">
+                                Aggressive — expect false positives; whitelist
+                                critical services as needed.
+                            </span>
+                        </div>
+                    </div>
+                    {homepage && (
+                        <Tooltip content={homepage} side="left" align="center">
+                            <Button
+                                variant="ghost"
+                                size="sm"
+                                className="p-1 h-auto shrink-0 text-[var(--tailwind-colors-rdns-600)]"
+                                onClick={() =>
+                                    window.open(
+                                        homepage,
+                                        "_blank",
+                                        "noopener,noreferrer",
+                                    )
+                                }
+                                aria-label={`Open ${homepage}`}
+                            >
+                                <ExternalLinkIcon className="h-4 w-4" />
+                            </Button>
+                        </Tooltip>
+                    )}
+                </div>
+
+                <div className="flex flex-col gap-2">
+                    <span className="text-[11px] font-medium uppercase tracking-wider text-[var(--tailwind-colors-slate-400)]">
+                        Registration window
+                    </span>
+                    <ToggleGroup
+                        type="single"
+                        value={String(depth)}
+                        onValueChange={handleChange}
+                        disabled={disabled}
+                        variant="outline"
+                        className="w-full border border-[var(--tailwind-colors-slate-700)]"
+                        aria-label="Newly registered domains range"
+                    >
+                        <ToggleGroupItem
+                            value="0"
+                            aria-label="Off — block no newly registered domains"
+                            className="text-xs data-[state=on]:!bg-[var(--tailwind-colors-slate-700)] data-[state=on]:!text-[var(--tailwind-colors-slate-50)]"
+                        >
+                            Off
+                        </ToggleGroupItem>
+                        {items.map((bl, i) => (
+                            <ToggleGroupItem
+                                key={bl.blocklist_id}
+                                value={String(i + 1)}
+                                aria-label={`Block domains registered in the ${labelById.get(bl.blocklist_id) ?? `${i + 1}`} window`}
+                                className="text-xs data-[state=on]:!bg-[var(--tailwind-colors-rdns-600)] data-[state=on]:!text-[var(--tailwind-colors-slate-50)]"
+                            >
+                                {labelById.get(bl.blocklist_id) ?? `T${i + 1}`}
+                            </ToggleGroupItem>
+                        ))}
+                    </ToggleGroup>
+                </div>
+
+                <div className="flex items-center justify-between text-xs text-[var(--tailwind-colors-slate-200)]">
+                    <span>
+                        {depth === 0
+                            ? "Not blocking newly registered domains"
+                            : `Blocking domains registered in the ${NRD_GROUP[depth - 1]?.window ?? "selected window"}`}
+                    </span>
+                    <span className="truncate ml-2">
+                        {depth === 0
+                            ? "0 entries"
+                            : `${formatEntries(selectedEntries)} entries${mostRecent ? ` · updated ${formatUpdatedRelative(mostRecent)}` : ""}`}
+                    </span>
+                </div>
+            </CardContent>
+        </Card>
+    );
+}
diff --git a/app/src/pages/blocklists/nrdGroup.ts b/app/src/pages/blocklists/nrdGroup.ts
new file mode 100644
index 00000000..ec3149f7
--- /dev/null
+++ b/app/src/pages/blocklists/nrdGroup.ts
@@ -0,0 +1,82 @@
+import type { ModelBlocklist } from "@/api/client/api";
+
+/**
+ * Presentation grouping for the Hagezi NRD (Newly Registered Domains) lists.
+ *
+ * The backend exposes the NRD windows as five independent, individually-toggleable
+ * blocklists. In the UI we collapse them into a single "range" card whose stepped
+ * control selects a registration-recency depth. The windows are non-overlapping
+ * slices designed to be combined cumulatively, so selecting depth `k` enables the
+ * first `k` tiers and disables the rest. This module holds the ordered id↔window
+ * mapping and the pure depth math so it can be unit-tested without rendering.
+ */
+
+export const NRD_TAG = "nrd";
+
+export interface NrdTier {
+    id: string;
+    /** Short label shown on the stepped control, e.g. "7d". */
+    label: string;
+    /** Cumulative window described to the user, e.g. "last 7 days". */
+    window: string;
+}
+
+/** Ordered shortest→longest registration-recency window. */
+export const NRD_GROUP: NrdTier[] = [
+    { id: "hagezi_nrd_07", label: "7d", window: "last 7 days" },
+    { id: "hagezi_nrd_14_08", label: "14d", window: "last 14 days" },
+    { id: "hagezi_nrd_21_15", label: "21d", window: "last 21 days" },
+    { id: "hagezi_nrd_28_22", label: "28d", window: "last 28 days" },
+    { id: "hagezi_nrd_35_29", label: "35d", window: "last 35 days" },
+];
+
+const NRD_IDS = new Set(NRD_GROUP.map((t) => t.id));
+
+/** True when a blocklist belongs to the NRD group (by tag or known id). */
+export function isNrdItem(bl: ModelBlocklist): boolean {
+    if (NRD_IDS.has(bl.blocklist_id)) return true;
+    return Array.isArray(bl.tags) && bl.tags.includes(NRD_TAG);
+}
+
+/**
+ * The NRD blocklists present in `items`, ordered shortest→longest window.
+ * Tiers not present in the data are skipped (the control adapts to what exists).
+ */
+export function orderedNrdItems(items: ModelBlocklist[]): ModelBlocklist[] {
+    const byId = new Map(items.map((bl) => [bl.blocklist_id, bl]));
+    return NRD_GROUP.map((t) => byId.get(t.id)).filter(
+        (bl): bl is ModelBlocklist => bl !== undefined,
+    );
+}
+
+/**
+ * Current selected depth = the highest enabled tier (1-based), or 0 for "Off".
+ * Using the highest (rather than a contiguous count) means a gapped selection
+ * still surfaces sensibly and self-heals to a contiguous set on the next change.
+ */
+export function nrdDepthFromEnabled(
+    orderedIds: string[],
+    enabled: Iterable<string>,
+): number {
+    const enabledSet = enabled instanceof Set ? enabled : new Set(enabled);
+    let depth = 0;
+    orderedIds.forEach((id, i) => {
+        if (enabledSet.has(id)) depth = i + 1;
+    });
+    return depth;
+}
+
+/**
+ * Given a target depth, the cumulative enable/disable sets over the ordered ids.
+ * `enable` = first `depth` tiers; `disable` = the remainder.
+ */
+export function nrdDepthTargets(
+    orderedIds: string[],
+    depth: number,
+): { enable: string[]; disable: string[] } {
+    const clamped = Math.max(0, Math.min(depth, orderedIds.length));
+    return {
+        enable: orderedIds.slice(0, clamped),
+        disable: orderedIds.slice(clamped),
+    };
+}

From dda4734016484a276f76669f580414e417e91819 Mon Sep 17 00:00:00 2001
From: Maciek <tomczukmaciej@gmail.com>
Date: Wed, 10 Jun 2026 15:03:14 +0200
Subject: [PATCH 03/15] fix(app): Adjust Security category enable/disable logic

Signed-off-by: Maciek <tomczukmaciej@gmail.com>
---
 app/src/__tests__/unit/NrdGroup.test.ts       | 55 +++++++++++++++++++
 .../blocklists/CategoriesContentSection.tsx   | 21 ++-----
 app/src/pages/blocklists/NrdRangeCard.tsx     |  4 +-
 app/src/pages/blocklists/nrdGroup.ts          | 32 +++++++++++
 4 files changed, 95 insertions(+), 17 deletions(-)

diff --git a/app/src/__tests__/unit/NrdGroup.test.ts b/app/src/__tests__/unit/NrdGroup.test.ts
index 738b255c..3cfc71d7 100644
--- a/app/src/__tests__/unit/NrdGroup.test.ts
+++ b/app/src/__tests__/unit/NrdGroup.test.ts
@@ -5,15 +5,22 @@ import {
     nrdDepthTargets,
     orderedNrdItems,
     isNrdItem,
+    categoryToggleTargets,
 } from "@/pages/blocklists/nrdGroup";
 import type { ModelBlocklist } from "@/api/client/api";
 
 const ids = NRD_GROUP.map((t) => t.id);
+const TIF = "hagezi_threat_intelligence_feeds_full";
 
 function bl(id: string, tags: string[] = []): ModelBlocklist {
     return { blocklist_id: id, tags } as unknown as ModelBlocklist;
 }
 
+// Security category as the UI groups it: TIF followed by the ordered NRD windows.
+const securityItems = [bl(TIF), ...ids.map((id) => bl(id))];
+// A plain content category with no NRD lists.
+const gamblingItems = [bl("hagezi_gambling"), bl("blp_gambling")];
+
 describe("nrdGroup depth math", () => {
     it("reports depth 0 when nothing is enabled", () => {
         expect(nrdDepthFromEnabled(ids, [])).toBe(0);
@@ -59,3 +66,51 @@ describe("nrdGroup item selection", () => {
         ]);
     });
 });
+
+describe("categoryToggleTargets (master switch)", () => {
+    it("returns null for an empty category", () => {
+        expect(categoryToggleTargets([], [])).toBeNull();
+    });
+
+    it("enables TIF + the 7d NRD window when the Security category is all-off", () => {
+        expect(categoryToggleTargets(securityItems, [])).toEqual({
+            ids: [TIF, ids[0]],
+            enable: true,
+        });
+    });
+
+    it("disables EVERYTHING (incl. all NRD) when only an NRD window is enabled", () => {
+        // Switch reads "on" because a deeper NRD window is enabled → click disables all.
+        expect(categoryToggleTargets(securityItems, [ids[2]])).toEqual({
+            ids: [TIF, ...ids],
+            enable: false,
+        });
+    });
+
+    it("disables EVERYTHING when only TIF is enabled", () => {
+        expect(categoryToggleTargets(securityItems, [TIF])).toEqual({
+            ids: [TIF, ...ids],
+            enable: false,
+        });
+    });
+
+    it("disables EVERYTHING when TIF and multiple NRD windows are enabled", () => {
+        expect(
+            categoryToggleTargets(securityItems, [TIF, ids[0], ids[1]]),
+        ).toEqual({ ids: [TIF, ...ids], enable: false });
+    });
+
+    it("enables all lists for a non-NRD category that is all-off", () => {
+        expect(categoryToggleTargets(gamblingItems, [])).toEqual({
+            ids: ["hagezi_gambling", "blp_gambling"],
+            enable: true,
+        });
+    });
+
+    it("disables all lists for a partially-enabled non-NRD category", () => {
+        expect(categoryToggleTargets(gamblingItems, ["blp_gambling"])).toEqual({
+            ids: ["hagezi_gambling", "blp_gambling"],
+            enable: false,
+        });
+    });
+});
diff --git a/app/src/pages/blocklists/CategoriesContentSection.tsx b/app/src/pages/blocklists/CategoriesContentSection.tsx
index 4a7d7da0..d298d322 100644
--- a/app/src/pages/blocklists/CategoriesContentSection.tsx
+++ b/app/src/pages/blocklists/CategoriesContentSection.tsx
@@ -2,7 +2,7 @@ import { type JSX, type LucideIcon, useMemo, useState, useRef, useEffect, useCal
 import BlocklistCard from "./BlocklistCard";
 import CategoryCard from "./CategoryCard";
 import NrdRangeCard from "./NrdRangeCard";
-import { isNrdItem, orderedNrdItems } from "./nrdGroup";
+import { categoryToggleTargets, isNrdItem, orderedNrdItems } from "./nrdGroup";
 import { ScrollArea } from "@/components/ui/scroll-area";
 import { Skeleton } from "@/components/ui/skeleton";
 import type { ModelBlocklist } from "@/api/client/api";
@@ -205,20 +205,11 @@ export default function CategoriesContentSection({
     }, [grouped, enabledBlocklists]);
 
     const handleCategoryToggle = (categoryKey: string) => {
-        // NRD lists are driven by their own range card, not the category master
-        // toggle — exclude them so a single click never enables every NRD window.
-        const items = (grouped.get(categoryKey) ?? []).filter((bl) => !isNrdItem(bl));
-        const allIds = items.map((bl) => bl.blocklist_id);
-        const enabledCount = items.filter((bl) =>
-            enabledBlocklists.includes(bl.blocklist_id)
-        ).length;
-
-        if (allIds.length === 0) return;
-        if (enabledCount > 0) {
-            onCategoryToggle(allIds, false);
-        } else {
-            onCategoryToggle(allIds, true);
-        }
+        const action = categoryToggleTargets(
+            grouped.get(categoryKey) ?? [],
+            enabledBlocklists,
+        );
+        if (action) onCategoryToggle(action.ids, action.enable);
     };
 
     // Find the expanded category's data for the panel
diff --git a/app/src/pages/blocklists/NrdRangeCard.tsx b/app/src/pages/blocklists/NrdRangeCard.tsx
index 4a7d31a4..6f2db4a4 100644
--- a/app/src/pages/blocklists/NrdRangeCard.tsx
+++ b/app/src/pages/blocklists/NrdRangeCard.tsx
@@ -136,7 +136,7 @@ export default function NrdRangeCard({
                         <ToggleGroupItem
                             value="0"
                             aria-label="Off — block no newly registered domains"
-                            className="text-xs data-[state=on]:!bg-[var(--tailwind-colors-slate-700)] data-[state=on]:!text-[var(--tailwind-colors-slate-50)]"
+                            className="text-xs cursor-pointer disabled:cursor-not-allowed data-[state=on]:!bg-[var(--tailwind-colors-slate-700)] data-[state=on]:!text-[var(--tailwind-colors-slate-50)]"
                         >
                             Off
                         </ToggleGroupItem>
@@ -145,7 +145,7 @@ export default function NrdRangeCard({
                                 key={bl.blocklist_id}
                                 value={String(i + 1)}
                                 aria-label={`Block domains registered in the ${labelById.get(bl.blocklist_id) ?? `${i + 1}`} window`}
-                                className="text-xs data-[state=on]:!bg-[var(--tailwind-colors-rdns-600)] data-[state=on]:!text-[var(--tailwind-colors-slate-50)]"
+                                className="text-xs cursor-pointer disabled:cursor-not-allowed data-[state=on]:!bg-[var(--tailwind-colors-rdns-600)] data-[state=on]:!text-[var(--tailwind-colors-slate-50)]"
                             >
                                 {labelById.get(bl.blocklist_id) ?? `T${i + 1}`}
                             </ToggleGroupItem>
diff --git a/app/src/pages/blocklists/nrdGroup.ts b/app/src/pages/blocklists/nrdGroup.ts
index ec3149f7..d2821557 100644
--- a/app/src/pages/blocklists/nrdGroup.ts
+++ b/app/src/pages/blocklists/nrdGroup.ts
@@ -80,3 +80,35 @@ export function nrdDepthTargets(
         disable: orderedIds.slice(clamped),
     };
 }
+
+/**
+ * The bulk action a category master-toggle click should issue, or `null` for a
+ * no-op. The master switch reads as "on" when ANY list in the category is
+ * enabled (including NRD windows), so the decision mirrors that:
+ *   - any enabled  → disable EVERYTHING, including all NRD windows;
+ *   - none enabled → enable the non-NRD lists (e.g. TIF) plus the shortest NRD
+ *     window (7d / depth 1). Deeper NRD ranges stay user-controlled via the
+ *     range card, so one click never switches on every NRD window at once.
+ * Categories without NRD lists collapse to plain enable-all / disable-all.
+ */
+export function categoryToggleTargets(
+    items: ModelBlocklist[],
+    enabledIds: Iterable<string>,
+): { ids: string[]; enable: boolean } | null {
+    if (items.length === 0) return null;
+    const enabledSet = enabledIds instanceof Set ? enabledIds : new Set(enabledIds);
+    const anyEnabled = items.some((bl) => enabledSet.has(bl.blocklist_id));
+
+    if (anyEnabled) {
+        return { ids: items.map((bl) => bl.blocklist_id), enable: false };
+    }
+
+    const nonNrdIds = items
+        .filter((bl) => !isNrdItem(bl))
+        .map((bl) => bl.blocklist_id);
+    const nrdOrdered = orderedNrdItems(items);
+    const firstNrdId = nrdOrdered.length > 0 ? [nrdOrdered[0].blocklist_id] : [];
+    const enableIds = [...nonNrdIds, ...firstNrdId];
+    if (enableIds.length === 0) return null;
+    return { ids: enableIds, enable: true };
+}

From 369bc1135e65fe7e10c1794b86d48207ab28ee09 Mon Sep 17 00:00:00 2001
From: Maciek <tomczukmaciej@gmail.com>
Date: Wed, 10 Jun 2026 16:30:15 +0200
Subject: [PATCH 04/15] refactor(blocklists): make Security a dedicated kind
 and set NRD hourly

Signed-off-by: Maciek <tomczukmaciej@gmail.com>
---
 blocklists/README.md                       |  4 +-
 blocklists/service/testdata/real/README.md |  2 +-
 blocklists/sources/security/nrd.json       | 52 +++++-----------------
 blocklists/sources/security/tif.json       |  3 +-
 4 files changed, 15 insertions(+), 46 deletions(-)

diff --git a/blocklists/README.md b/blocklists/README.md
index dd05349e..48fec434 100644
--- a/blocklists/README.md
+++ b/blocklists/README.md
@@ -66,8 +66,8 @@ The **extractor is selected by the `blocklist_id` prefix**
 | `blp_*`, `ut1_*`, `shadowwhisperer_*`, `someonewhocares_*`, `peter_lowe*`, `1hosts_*` | Domains | plain or hosts-format domains, graceful metadata (optional `Last modified`/`Last updated`/`Count` headers), hosts-tolerant |
 
 Key source fields: `blocklist_id` (required, routes the extractor), `name`,
-`description`, `source_url`, `kind` (`general`/`category`),
-`category` (e.g. `gambling`, `security`), `intensity`, `default`,
+`description`, `source_url`, `kind` (`general`/`category`/`security`),
+`category` (e.g. `gambling`, only when `kind=category`), `intensity`, `default`,
 `schedule` (cron). See any file under
 `sources/` for a complete example.
 
diff --git a/blocklists/service/testdata/real/README.md b/blocklists/service/testdata/real/README.md
index 20c84f48..ed9b51fb 100644
--- a/blocklists/service/testdata/real/README.md
+++ b/blocklists/service/testdata/real/README.md
@@ -28,7 +28,7 @@ its own license (see the source repos).
 | blp_fakenews.txt | blp_fakenews | Domains | https://github.com/marktron/fakenews (hosts format) |
 | ut1.txt | ut1_gaming | Domains | https://github.com/olbat/ut1-blacklists (games/domains) |
 | shadowwhisperer.txt | shadowwhisperer_dating | Domains | https://github.com/ShadowWhisperer/BlockLists (RAW/Dating) |
-| hagezi_tif.txt | hagezi_threat_intelligence_feeds_full | Hagezi | https://github.com/hagezi/dns-blocklists (domains/tif.txt, security category) |
+| hagezi_tif.txt | hagezi_threat_intelligence_feeds_full | Hagezi | https://github.com/hagezi/dns-blocklists (domains/tif.txt, security) |
 | hagezi_nsfw.txt | hagezi_nsfw | Hagezi | https://github.com/hagezi/dns-blocklists (wildcard/nsfw-onlydomains.txt) |
 | blp_drugs.txt | blp_drugs | Domains | https://github.com/blocklistproject/Lists (alt-version/drugs-nl.txt) |
 | ut1_dating.txt | ut1_dating | Domains | https://github.com/olbat/ut1-blacklists (dating/domains) |
diff --git a/blocklists/sources/security/nrd.json b/blocklists/sources/security/nrd.json
index b5c76534..3cd0f926 100644
--- a/blocklists/sources/security/nrd.json
+++ b/blocklists/sources/security/nrd.json
@@ -6,14 +6,8 @@
     "source_url": "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/domains/nrd7.txt",
     "homepage": "https://github.com/hagezi/dns-blocklists",
     "syntax": "domains",
-    "kind": "category",
-    "category": "security",
-    "tags": [
-      "category",
-      "security",
-      "hagezi",
-      "nrd"
-    ],
+    "kind": "security",
+    "tags": ["security", "hagezi", "nrd"],
     "schedule": "@hourly",
     "default": false
   },
@@ -24,14 +18,8 @@
     "source_url": "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/domains/nrd14-8.txt",
     "homepage": "https://github.com/hagezi/dns-blocklists",
     "syntax": "domains",
-    "kind": "category",
-    "category": "security",
-    "tags": [
-      "category",
-      "security",
-      "hagezi",
-      "nrd"
-    ],
+    "kind": "security",
+    "tags": ["security", "hagezi", "nrd"],
     "schedule": "@hourly",
     "default": false
   },
@@ -42,14 +30,8 @@
     "source_url": "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/domains/nrd21-15.txt",
     "homepage": "https://github.com/hagezi/dns-blocklists",
     "syntax": "domains",
-    "kind": "category",
-    "category": "security",
-    "tags": [
-      "category",
-      "security",
-      "hagezi",
-      "nrd"
-    ],
+    "kind": "security",
+    "tags": ["security", "hagezi", "nrd"],
     "schedule": "@hourly",
     "default": false
   },
@@ -60,14 +42,8 @@
     "source_url": "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/domains/nrd28-22.txt",
     "homepage": "https://github.com/hagezi/dns-blocklists",
     "syntax": "domains",
-    "kind": "category",
-    "category": "security",
-    "tags": [
-      "category",
-      "security",
-      "hagezi",
-      "nrd"
-    ],
+    "kind": "security",
+    "tags": ["security", "hagezi", "nrd"],
     "schedule": "@hourly",
     "default": false
   },
@@ -78,15 +54,9 @@
     "source_url": "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/domains/nrd35-29.txt",
     "homepage": "https://github.com/hagezi/dns-blocklists",
     "syntax": "domains",
-    "kind": "category",
-    "category": "security",
-    "tags": [
-      "category",
-      "security",
-      "hagezi",
-      "nrd"
-    ],
+    "kind": "security",
+    "tags": ["security", "hagezi", "nrd"],
     "schedule": "@hourly",
     "default": false
   }
-]
\ No newline at end of file
+]
diff --git a/blocklists/sources/security/tif.json b/blocklists/sources/security/tif.json
index c17a9eb9..3c3c6c1c 100644
--- a/blocklists/sources/security/tif.json
+++ b/blocklists/sources/security/tif.json
@@ -6,8 +6,7 @@
     "source_url": "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/domains/tif.txt",
     "homepage": "https://github.com/hagezi/dns-blocklists",
     "syntax": "domains",
-    "kind": "category",
-    "category": "security",
+    "kind": "security",
     "intensity": ["comprehensive", "restrictive"],
     "tags": ["comprehensive"],
     "schedule": "@hourly",

From e0e8eab2330e23c3dec50054f5b009ed4c073ad1 Mon Sep 17 00:00:00 2001
From: Maciek <tomczukmaciej@gmail.com>
Date: Wed, 10 Jun 2026 16:31:19 +0200
Subject: [PATCH 05/15] refactor(app): move Security into its dedicated tab

Signed-off-by: Maciek <tomczukmaciej@gmail.com>
---
 app/src/__tests__/unit/NrdGroup.test.ts       | 55 -----------
 .../blocklists/CategoriesContentSection.tsx   | 91 +++++++----------
 .../pages/blocklists/MainContentSection.tsx   | 27 +++++-
 .../blocklists/SecurityContentSection.tsx     | 97 +++++++++++++++++++
 app/src/pages/blocklists/nrdGroup.ts          | 32 ------
 5 files changed, 154 insertions(+), 148 deletions(-)
 create mode 100644 app/src/pages/blocklists/SecurityContentSection.tsx

diff --git a/app/src/__tests__/unit/NrdGroup.test.ts b/app/src/__tests__/unit/NrdGroup.test.ts
index 3cfc71d7..738b255c 100644
--- a/app/src/__tests__/unit/NrdGroup.test.ts
+++ b/app/src/__tests__/unit/NrdGroup.test.ts
@@ -5,22 +5,15 @@ import {
     nrdDepthTargets,
     orderedNrdItems,
     isNrdItem,
-    categoryToggleTargets,
 } from "@/pages/blocklists/nrdGroup";
 import type { ModelBlocklist } from "@/api/client/api";
 
 const ids = NRD_GROUP.map((t) => t.id);
-const TIF = "hagezi_threat_intelligence_feeds_full";
 
 function bl(id: string, tags: string[] = []): ModelBlocklist {
     return { blocklist_id: id, tags } as unknown as ModelBlocklist;
 }
 
-// Security category as the UI groups it: TIF followed by the ordered NRD windows.
-const securityItems = [bl(TIF), ...ids.map((id) => bl(id))];
-// A plain content category with no NRD lists.
-const gamblingItems = [bl("hagezi_gambling"), bl("blp_gambling")];
-
 describe("nrdGroup depth math", () => {
     it("reports depth 0 when nothing is enabled", () => {
         expect(nrdDepthFromEnabled(ids, [])).toBe(0);
@@ -66,51 +59,3 @@ describe("nrdGroup item selection", () => {
         ]);
     });
 });
-
-describe("categoryToggleTargets (master switch)", () => {
-    it("returns null for an empty category", () => {
-        expect(categoryToggleTargets([], [])).toBeNull();
-    });
-
-    it("enables TIF + the 7d NRD window when the Security category is all-off", () => {
-        expect(categoryToggleTargets(securityItems, [])).toEqual({
-            ids: [TIF, ids[0]],
-            enable: true,
-        });
-    });
-
-    it("disables EVERYTHING (incl. all NRD) when only an NRD window is enabled", () => {
-        // Switch reads "on" because a deeper NRD window is enabled → click disables all.
-        expect(categoryToggleTargets(securityItems, [ids[2]])).toEqual({
-            ids: [TIF, ...ids],
-            enable: false,
-        });
-    });
-
-    it("disables EVERYTHING when only TIF is enabled", () => {
-        expect(categoryToggleTargets(securityItems, [TIF])).toEqual({
-            ids: [TIF, ...ids],
-            enable: false,
-        });
-    });
-
-    it("disables EVERYTHING when TIF and multiple NRD windows are enabled", () => {
-        expect(
-            categoryToggleTargets(securityItems, [TIF, ids[0], ids[1]]),
-        ).toEqual({ ids: [TIF, ...ids], enable: false });
-    });
-
-    it("enables all lists for a non-NRD category that is all-off", () => {
-        expect(categoryToggleTargets(gamblingItems, [])).toEqual({
-            ids: ["hagezi_gambling", "blp_gambling"],
-            enable: true,
-        });
-    });
-
-    it("disables all lists for a partially-enabled non-NRD category", () => {
-        expect(categoryToggleTargets(gamblingItems, ["blp_gambling"])).toEqual({
-            ids: ["hagezi_gambling", "blp_gambling"],
-            enable: false,
-        });
-    });
-});
diff --git a/app/src/pages/blocklists/CategoriesContentSection.tsx b/app/src/pages/blocklists/CategoriesContentSection.tsx
index d298d322..3f4c9c9c 100644
--- a/app/src/pages/blocklists/CategoriesContentSection.tsx
+++ b/app/src/pages/blocklists/CategoriesContentSection.tsx
@@ -1,8 +1,6 @@
 import { type JSX, type LucideIcon, useMemo, useState, useRef, useEffect, useCallback } from "react";
 import BlocklistCard from "./BlocklistCard";
 import CategoryCard from "./CategoryCard";
-import NrdRangeCard from "./NrdRangeCard";
-import { categoryToggleTargets, isNrdItem, orderedNrdItems } from "./nrdGroup";
 import { ScrollArea } from "@/components/ui/scroll-area";
 import { Skeleton } from "@/components/ui/skeleton";
 import type { ModelBlocklist } from "@/api/client/api";
@@ -10,7 +8,6 @@ import { formatUpdatedRelative } from "./MainContentSection";
 import {
     Dices,
     ShieldAlert,
-    ShieldCheck,
     Heart,
     Pill,
     Users,
@@ -26,7 +23,6 @@ import {
 // Categories are derived from the API data — only categories present in the data are shown.
 // New categories added to the backend appear automatically; add an entry here for a custom icon/label.
 const CATEGORY_META: Record<string, { label: string; icon: LucideIcon; description: string }> = {
-    security: { label: "Security", icon: ShieldCheck, description: "Block malware, phishing, scam and threat-intelligence domains" },
     gambling: { label: "Gambling", icon: Dices, description: "Block online casinos, betting platforms, and lottery services" },
     adult: { label: "Adult Content", icon: ShieldAlert, description: "Block adult and explicit content websites" },
     dating: { label: "Dating", icon: Heart, description: "Block dating apps and matchmaking services" },
@@ -141,8 +137,6 @@ interface CategoriesContentSectionProps {
     enabledBlocklists: string[];
     onToggle: (id: string, checked: boolean) => void;
     onCategoryToggle: (blocklistIds: string[], enable: boolean) => void;
-    /** Apply an exact target set (enable some ids, disable others) in one action. */
-    onApplySet: (enableIds: string[], disableIds: string[]) => void;
     updating: string | null;
     loading: boolean;
     restricted?: boolean;
@@ -164,7 +158,6 @@ export default function CategoriesContentSection({
     enabledBlocklists,
     onToggle,
     onCategoryToggle,
-    onApplySet,
     updating,
     loading,
     restricted = false,
@@ -205,11 +198,13 @@ export default function CategoriesContentSection({
     }, [grouped, enabledBlocklists]);
 
     const handleCategoryToggle = (categoryKey: string) => {
-        const action = categoryToggleTargets(
-            grouped.get(categoryKey) ?? [],
-            enabledBlocklists,
-        );
-        if (action) onCategoryToggle(action.ids, action.enable);
+        const items = grouped.get(categoryKey) ?? [];
+        const allIds = items.map((bl) => bl.blocklist_id);
+        if (allIds.length === 0) return;
+        const enabledCount = items.filter((bl) =>
+            enabledBlocklists.includes(bl.blocklist_id)
+        ).length;
+        onCategoryToggle(allIds, enabledCount === 0);
     };
 
     // Find the expanded category's data for the panel
@@ -273,7 +268,6 @@ export default function CategoriesContentSection({
                                 setExpandedCategory(expandedCategory === key ? null : key)
                             }
                             onBlocklistToggle={onToggle}
-                            onApplySet={onApplySet}
                             restricted={restricted}
                         />
                     )}
@@ -325,7 +319,6 @@ interface CategoriesGridProps {
     onCategoryToggle: (key: string) => void;
     onExpandToggle: (key: string) => void;
     onBlocklistToggle: (id: string, checked: boolean) => void;
-    onApplySet: (enableIds: string[], disableIds: string[]) => void;
     restricted?: boolean;
 }
 
@@ -338,7 +331,6 @@ function CategoriesGrid({
     onCategoryToggle,
     onExpandToggle,
     onBlocklistToggle,
-    onApplySet,
     restricted = false,
 }: CategoriesGridProps) {
     return (
@@ -361,49 +353,32 @@ function CategoriesGrid({
                             onExpandToggle={() => onExpandToggle(cat.key)}
                         />
 
-                        {isExpanded && expandedData && (() => {
-                            // NRD lists collapse into a single range card; everything
-                            // else renders as an individual toggle card.
-                            const nrdItems = orderedNrdItems(expandedData.items);
-                            const regularItems = expandedData.items.filter((bl) => !isNrdItem(bl));
-                            return (
-                                <div className="col-[1/-1]">
-                                    <ExpandPanel
-                                        expanded
-                                        categoryLabel={expandedData.label}
-                                        categoryIcon={expandedData.icon}
-                                    >
-                                        {nrdItems.length > 0 && (
-                                            <div className="col-span-1 sm:col-span-2 md:col-span-3 xl:col-span-4">
-                                                <NrdRangeCard
-                                                    items={nrdItems}
-                                                    enabledBlocklists={enabledBlocklists}
-                                                    onApplySet={onApplySet}
-                                                    updating={updating}
-                                                    restricted={restricted}
-                                                />
-                                            </div>
-                                        )}
-                                        {regularItems.map((bl) => {
-                                            const isEnabled = enabledBlocklists.includes(bl.blocklist_id);
-                                            return (
-                                                <BlocklistCard
-                                                    key={bl.blocklist_id}
-                                                    title={bl.name}
-                                                    description={bl.description}
-                                                    entries={bl.entries}
-                                                    updated={formatUpdatedRelative(bl.last_modified)}
-                                                    onSwitchChange={(checked) => onBlocklistToggle(bl.blocklist_id, checked)}
-                                                    switchChecked={isEnabled}
-                                                    switchDisabled={updating === bl.blocklist_id || restricted}
-                                                    homepage={bl.homepage}
-                                                />
-                                            );
-                                        })}
-                                    </ExpandPanel>
-                                </div>
-                            );
-                        })()}
+                        {isExpanded && expandedData && (
+                            <div className="col-[1/-1]">
+                                <ExpandPanel
+                                    expanded
+                                    categoryLabel={expandedData.label}
+                                    categoryIcon={expandedData.icon}
+                                >
+                                    {expandedData.items.map((bl) => {
+                                        const isEnabled = enabledBlocklists.includes(bl.blocklist_id);
+                                        return (
+                                            <BlocklistCard
+                                                key={bl.blocklist_id}
+                                                title={bl.name}
+                                                description={bl.description}
+                                                entries={bl.entries}
+                                                updated={formatUpdatedRelative(bl.last_modified)}
+                                                onSwitchChange={(checked) => onBlocklistToggle(bl.blocklist_id, checked)}
+                                                switchChecked={isEnabled}
+                                                switchDisabled={updating === bl.blocklist_id || restricted}
+                                                homepage={bl.homepage}
+                                            />
+                                        );
+                                    })}
+                                </ExpandPanel>
+                            </div>
+                        )}
                     </div>
                 );
             })}
diff --git a/app/src/pages/blocklists/MainContentSection.tsx b/app/src/pages/blocklists/MainContentSection.tsx
index b2516448..35508184 100644
--- a/app/src/pages/blocklists/MainContentSection.tsx
+++ b/app/src/pages/blocklists/MainContentSection.tsx
@@ -34,6 +34,7 @@ import { toast } from "sonner";
 import axios from "axios";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import ServicesContentSection from "@/pages/blocklists/ServicesContentSection";
+import SecurityContentSection from "@/pages/blocklists/SecurityContentSection";
 import CategoriesContentSection from "@/pages/blocklists/CategoriesContentSection";
 
 const INDIVIDUAL_LISTS = [
@@ -244,8 +245,12 @@ export default function MainContentSection(): JSX.Element {
         }
     };
 
-    // Split into regular and category blocklists using the `kind` field
-    const regularBlocklists = blocklists.filter((bl) => bl.kind !== "category");
+    // Split blocklists by `kind`: general lists (Lists tab), security lists
+    // (Security tab) and content categories (Categories tab).
+    const regularBlocklists = blocklists.filter(
+        (bl) => bl.kind !== "category" && bl.kind !== "security"
+    );
+    const securityBlocklists = blocklists.filter((bl) => bl.kind === "security");
     const categoryBlocklists = blocklists.filter((bl) => bl.kind === "category");
 
     // Filter blocklists by search and filter value (basic, comprehensive, restrictive, all)
@@ -354,6 +359,9 @@ export default function MainContentSection(): JSX.Element {
                         <TabsTrigger value="blocklists" className={tabTriggerClassName}>
                             Lists
                         </TabsTrigger>
+                        <TabsTrigger value="security" className={tabTriggerClassName}>
+                            Security
+                        </TabsTrigger>
                         <TabsTrigger value="categories" className={tabTriggerClassName}>
                             Categories
                         </TabsTrigger>
@@ -576,6 +584,20 @@ export default function MainContentSection(): JSX.Element {
                     </div>
                 </TabsContent>
 
+                <TabsContent value="security" className="mt-4">
+                    {activeTab === "security" ? (
+                        <SecurityContentSection
+                            blocklists={securityBlocklists}
+                            enabledBlocklists={enabledBlocklists}
+                            onToggle={handleBlocklistSwitch}
+                            onApplySet={handleApplyBlocklistSet}
+                            updating={updating}
+                            loading={loading}
+                            restricted={isRestricted}
+                        />
+                    ) : null}
+                </TabsContent>
+
                 <TabsContent value="services" className="mt-4">
                     {activeTab === "services" ? <ServicesContentSection restricted={isRestricted} /> : null}
                 </TabsContent>
@@ -587,7 +609,6 @@ export default function MainContentSection(): JSX.Element {
                             enabledBlocklists={enabledBlocklists}
                             onToggle={handleBlocklistSwitch}
                             onCategoryToggle={handleCategoryToggle}
-                            onApplySet={handleApplyBlocklistSet}
                             updating={updating}
                             loading={loading}
                             restricted={isRestricted}
diff --git a/app/src/pages/blocklists/SecurityContentSection.tsx b/app/src/pages/blocklists/SecurityContentSection.tsx
new file mode 100644
index 00000000..5b78092d
--- /dev/null
+++ b/app/src/pages/blocklists/SecurityContentSection.tsx
@@ -0,0 +1,97 @@
+import { type JSX } from "react";
+import BlocklistCard from "./BlocklistCard";
+import NrdRangeCard from "./NrdRangeCard";
+import { isNrdItem, orderedNrdItems } from "./nrdGroup";
+import { ScrollArea } from "@/components/ui/scroll-area";
+import { Skeleton } from "@/components/ui/skeleton";
+import type { ModelBlocklist } from "@/api/client/api";
+import { formatUpdatedRelative } from "./MainContentSection";
+
+interface SecurityContentSectionProps {
+    blocklists: ModelBlocklist[];
+    enabledBlocklists: string[];
+    onToggle: (id: string, checked: boolean) => void;
+    /** Apply an exact target set (enable some ids, disable others) in one action. */
+    onApplySet: (enableIds: string[], disableIds: string[]) => void;
+    updating: string | null;
+    loading: boolean;
+    restricted?: boolean;
+}
+
+/**
+ * Security tab — threat-protection blocklists (kind="security"). Renders the
+ * Hagezi NRD windows as a single range card and every other security list (e.g.
+ * Threat Intelligence Feeds) as an individual toggle card.
+ */
+export default function SecurityContentSection({
+    blocklists,
+    enabledBlocklists,
+    onToggle,
+    onApplySet,
+    updating,
+    loading,
+    restricted = false,
+}: SecurityContentSectionProps): JSX.Element {
+    const nrdItems = orderedNrdItems(blocklists);
+    const regularItems = blocklists.filter((bl) => !isNrdItem(bl));
+
+    return (
+        <div className="flex flex-col w-full items-start gap-6">
+            <section className="w-full">
+                <p className="text-[var(--tailwind-colors-slate-200)] text-base leading-6">
+                    Security blocklists protect against malware, phishing, scams and
+                    other threats. Threat Intelligence Feeds is enabled by default.
+                </p>
+            </section>
+
+            <section className="w-full">
+                <ScrollArea className="w-full">
+                    {loading ? (
+                        <div className="grid grid-cols-1 sm:grid-cols-2 md:grid-cols-3 xl:grid-cols-4 gap-6 pb-8">
+                            {Array.from({ length: 4 }).map((_, i) => (
+                                <div key={i} className="rounded-lg border border-[var(--tailwind-colors-slate-700)] p-4 space-y-3">
+                                    <div className="flex items-center justify-between">
+                                        <Skeleton className="h-5 w-32" />
+                                        <Skeleton className="h-5 w-10 rounded-full" />
+                                    </div>
+                                    <Skeleton className="h-4 w-full" />
+                                    <Skeleton className="h-4 w-3/4" />
+                                </div>
+                            ))}
+                        </div>
+                    ) : (
+                        <div className="grid grid-cols-1 sm:grid-cols-2 md:grid-cols-3 xl:grid-cols-4 gap-6 pb-8">
+                            {nrdItems.length > 0 && (
+                                <div className="col-span-1 sm:col-span-2 md:col-span-3 xl:col-span-4">
+                                    <NrdRangeCard
+                                        items={nrdItems}
+                                        enabledBlocklists={enabledBlocklists}
+                                        onApplySet={onApplySet}
+                                        updating={updating}
+                                        restricted={restricted}
+                                    />
+                                </div>
+                            )}
+                            {regularItems.map((bl) => {
+                                const isEnabled = enabledBlocklists.includes(bl.blocklist_id);
+                                return (
+                                    <BlocklistCard
+                                        key={bl.blocklist_id}
+                                        title={bl.name}
+                                        description={bl.description}
+                                        entries={bl.entries}
+                                        updated={formatUpdatedRelative(bl.last_modified)}
+                                        onSwitchChange={(checked) => onToggle(bl.blocklist_id, checked)}
+                                        switchChecked={isEnabled}
+                                        switchDisabled={updating === bl.blocklist_id || restricted}
+                                        homepage={bl.homepage}
+                                    />
+                                );
+                            })}
+                        </div>
+                    )}
+                </ScrollArea>
+            </section>
+        </div>
+    );
+}
diff --git a/app/src/pages/blocklists/nrdGroup.ts b/app/src/pages/blocklists/nrdGroup.ts
index d2821557..ec3149f7 100644
--- a/app/src/pages/blocklists/nrdGroup.ts
+++ b/app/src/pages/blocklists/nrdGroup.ts
@@ -80,35 +80,3 @@ export function nrdDepthTargets(
         disable: orderedIds.slice(clamped),
     };
 }
-
-/**
- * The bulk action a category master-toggle click should issue, or `null` for a
- * no-op. The master switch reads as "on" when ANY list in the category is
- * enabled (including NRD windows), so the decision mirrors that:
- *   - any enabled  → disable EVERYTHING, including all NRD windows;
- *   - none enabled → enable the non-NRD lists (e.g. TIF) plus the shortest NRD
- *     window (7d / depth 1). Deeper NRD ranges stay user-controlled via the
- *     range card, so one click never switches on every NRD window at once.
- * Categories without NRD lists collapse to plain enable-all / disable-all.
- */
-export function categoryToggleTargets(
-    items: ModelBlocklist[],
-    enabledIds: Iterable<string>,
-): { ids: string[]; enable: boolean } | null {
-    if (items.length === 0) return null;
-    const enabledSet = enabledIds instanceof Set ? enabledIds : new Set(enabledIds);
-    const anyEnabled = items.some((bl) => enabledSet.has(bl.blocklist_id));
-
-    if (anyEnabled) {
-        return { ids: items.map((bl) => bl.blocklist_id), enable: false };
-    }
-
-    const nonNrdIds = items
-        .filter((bl) => !isNrdItem(bl))
-        .map((bl) => bl.blocklist_id);
-    const nrdOrdered = orderedNrdItems(items);
-    const firstNrdId = nrdOrdered.length > 0 ? [nrdOrdered[0].blocklist_id] : [];
-    const enableIds = [...nonNrdIds, ...firstNrdId];
-    if (enableIds.length === 0) return null;
-    return { ids: enableIds, enable: true };
-}

From 6813128e6fa68bb681972f12085b058dad294ed6 Mon Sep 17 00:00:00 2001
From: Maciek <tomczukmaciej@gmail.com>
Date: Wed, 10 Jun 2026 16:40:11 +0200
Subject: [PATCH 06/15] chore(blocklists): Update Dan Pollock blocklist
 description

Signed-off-by: Maciek <tomczukmaciej@gmail.com>
---
 blocklists/sources/3rd_party/someonewhocares.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blocklists/sources/3rd_party/someonewhocares.json b/blocklists/sources/3rd_party/someonewhocares.json
index 23f40829..7059f5c4 100644
--- a/blocklists/sources/3rd_party/someonewhocares.json
+++ b/blocklists/sources/3rd_party/someonewhocares.json
@@ -2,7 +2,7 @@
   {
     "blocklist_id": "someonewhocares_hosts",
     "name": "Dan Pollock's hosts",
-    "description": "A comprehensive, frequently-updated hosts list by Dan Pollock blocking ads, trackers, malware and other unwanted content.",
+    "description": "A comprehensive, frequently-updated hosts list by Dan Pollock (someonewhocares.org) blocking ads, trackers, malware and other unwanted content.",
     "source_url": "https://someonewhocares.org/hosts/zero/hosts",
     "homepage": "https://someonewhocares.org/hosts/",
     "syntax": "hosts",

From d1348fea928b98aa3db80922e5784cf4d6fd29ab Mon Sep 17 00:00:00 2001
From: Maciek <tomczukmaciej@gmail.com>
Date: Thu, 11 Jun 2026 11:00:34 +0200
Subject: [PATCH 07/15] fix(blocklists): batch Redis pipeline flushes to avoid
 i/o timeout

Signed-off-by: Maciek <tomczukmaciej@gmail.com>
---
 blocklists/cache/redis.go      |  46 +++++++++++---
 blocklists/cache/redis_test.go | 109 +++++++++++++++++++++++++++++++++
 blocklists/go.mod              |   2 +
 blocklists/go.sum              |   4 ++
 4 files changed, 153 insertions(+), 8 deletions(-)
 create mode 100644 blocklists/cache/redis_test.go

diff --git a/blocklists/cache/redis.go b/blocklists/cache/redis.go
index b7cc6d95..0b1b5e29 100644
--- a/blocklists/cache/redis.go
+++ b/blocklists/cache/redis.go
@@ -10,7 +10,17 @@ import (
 	"github.com/rs/zerolog/log"
 )
 
-const chunkSize = 5000
+const (
+	// chunkSize is the number of members added per SADD command.
+	chunkSize = 5000
+	// flushEvery is the number of buffered commands sent per pipeline
+	// round-trip. The full blocklist is never flushed as a single batch: large
+	// NRD lists hold millions of entries, and writing the whole pipeline under
+	// one socket write deadline overwhelms the master's drain rate and triggers
+	// "i/o timeout". Flushing in bounded batches keeps each round-trip small and
+	// gives each its own write deadline (~250k members per flush at chunkSize).
+	flushEvery = 50
+)
 
 // RedisCache is a cache implementation using Redis
 type RedisCache struct {
@@ -36,13 +46,14 @@ func (c *RedisCache) CreateOrUpdateBlocklist(ctx context.Context, blocklistId st
 	tempBlocklistName := fmt.Sprintf("%s_temp", blocklistName)
 	oldBlocklistName := fmt.Sprintf("%s_old", blocklistName)
 
+	// Step 1: Populate the temp set with new data, flushing in bounded batches.
 	pipe := c.client.Pipeline()
 
 	// Step 0: Clear any stale temp set left by a previously crashed run, so the
 	// new set is not silently merged with old data.
 	pipe.Del(ctx, tempBlocklistName)
+	buffered := 1 // the Del command above
 
-	// Step 1: Create the temp set with new data
 	lines := strings.Split(string(data), "\n")
 	for i := 0; i < len(lines); i += chunkSize {
 		end := i + chunkSize
@@ -55,18 +66,37 @@ func (c *RedisCache) CreateOrUpdateBlocklist(ctx context.Context, blocklistId st
 			continue
 		}
 		pipe.SAdd(ctx, tempBlocklistName, chunk)
+
+		if buffered++; buffered >= flushEvery {
+			if _, err := pipe.Exec(ctx); err != nil {
+				log.Err(err).Str("component", "cache").Msg("Cache: pipeline execution failed")
+				return err
+			}
+			pipe = c.client.Pipeline()
+			buffered = 0
+		}
+	}
+	// Flush any commands still buffered (the initial Del plus trailing SADDs).
+	if buffered > 0 {
+		if _, err := pipe.Exec(ctx); err != nil {
+			log.Err(err).Str("component", "cache").Msg("Cache: pipeline execution failed")
+			return err
+		}
 	}
 
-	// Step 2: Atomically swap sets using RENAME
+	// Step 2: Atomically swap the populated temp set into place. A pipeline is
+	// not a transaction, so this is kept separate from population; the only
+	// atomic unit that matters is each individual RENAME.
+	swap := c.client.Pipeline()
 	// If the original blocklist exists, rename it to _old
-	renameNXCmd := pipe.RenameNX(ctx, blocklistName, oldBlocklistName)
+	renameNXCmd := swap.RenameNX(ctx, blocklistName, oldBlocklistName)
 	// Rename temp set to the main blocklist name
-	pipe.Rename(ctx, tempBlocklistName, blocklistName)
+	swap.Rename(ctx, tempBlocklistName, blocklistName)
 	// Step 3: Delete the old set
-	pipe.Del(ctx, oldBlocklistName)
+	swap.Del(ctx, oldBlocklistName)
 
-	// Commit all commands in the pipeline
-	cmds, err := pipe.Exec(ctx)
+	// Commit the swap commands in the pipeline
+	cmds, err := swap.Exec(ctx)
 	if err != nil {
 		// Check if the only error is "ERR no such key" from RENAME or RENAME_NX
 		ignore := false
diff --git a/blocklists/cache/redis_test.go b/blocklists/cache/redis_test.go
new file mode 100644
index 00000000..25060528
--- /dev/null
+++ b/blocklists/cache/redis_test.go
@@ -0,0 +1,109 @@
+package cache
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/alicebob/miniredis/v2"
+	"github.com/redis/go-redis/v9"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newTestCache(t *testing.T) (*RedisCache, *miniredis.Miniredis) {
+	t.Helper()
+	mr, err := miniredis.Run()
+	require.NoError(t, err)
+	t.Cleanup(mr.Close)
+
+	rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
+	t.Cleanup(func() { _ = rdb.Close() })
+
+	return &RedisCache{client: rdb}, mr
+}
+
+func makeDomains(n int) []byte {
+	var b strings.Builder
+	for i := 0; i < n; i++ {
+		if i > 0 {
+			b.WriteByte('\n')
+		}
+		fmt.Fprintf(&b, "d%d.example.com", i)
+	}
+	return []byte(b.String())
+}
+
+// TestCreateOrUpdateBlocklist_LargeInputMultipleFlushes verifies that an input
+// large enough to span more than one pipeline flush batch is stored completely
+// and leaves no temp/old residue. Guards the batched-flush refactor.
+func TestCreateOrUpdateBlocklist_LargeInputMultipleFlushes(t *testing.T) {
+	rc, mr := newTestCache(t)
+	ctx := context.Background()
+
+	// 260k entries => 52 SADD commands => crosses the flushEvery boundary,
+	// forcing at least two pipeline Exec round-trips.
+	const n = 260_000
+	require.NoError(t, rc.CreateOrUpdateBlocklist(ctx, "big", makeDomains(n)))
+
+	card, err := rc.client.SCard(ctx, "blocklist:big").Result()
+	require.NoError(t, err)
+	assert.Equal(t, int64(n), card)
+
+	ok, err := rc.client.SIsMember(ctx, "blocklist:big", "d259999.example.com").Result()
+	require.NoError(t, err)
+	assert.True(t, ok, "last member should be present after multiple flushes")
+
+	assert.False(t, mr.Exists("blocklist:big_temp"), "temp set must not survive")
+	assert.False(t, mr.Exists("blocklist:big_old"), "old set must not survive")
+}
+
+// TestCreateOrUpdateBlocklist_FirstRun covers the path where the target set does
+// not yet exist (RENAMENX hits "no such key", which must be ignored).
+func TestCreateOrUpdateBlocklist_FirstRun(t *testing.T) {
+	rc, mr := newTestCache(t)
+	ctx := context.Background()
+
+	require.NoError(t, rc.CreateOrUpdateBlocklist(ctx, "fresh", []byte("a.com\nb.com\nc.com")))
+
+	members, err := rc.client.SMembers(ctx, "blocklist:fresh").Result()
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"a.com", "b.com", "c.com"}, members)
+	assert.False(t, mr.Exists("blocklist:fresh_temp"))
+	assert.False(t, mr.Exists("blocklist:fresh_old"))
+}
+
+// TestCreateOrUpdateBlocklist_ReplacesExisting verifies the atomic swap fully
+// replaces a previously stored set (no stale members from the old version).
+func TestCreateOrUpdateBlocklist_ReplacesExisting(t *testing.T) {
+	rc, mr := newTestCache(t)
+	ctx := context.Background()
+
+	require.NoError(t, rc.CreateOrUpdateBlocklist(ctx, "swap", []byte("old1.com\nold2.com")))
+	require.NoError(t, rc.CreateOrUpdateBlocklist(ctx, "swap", []byte("new1.com\nnew2.com\nnew3.com")))
+
+	members, err := rc.client.SMembers(ctx, "blocklist:swap").Result()
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"new1.com", "new2.com", "new3.com"}, members)
+	assert.False(t, mr.Exists("blocklist:swap_temp"))
+	assert.False(t, mr.Exists("blocklist:swap_old"))
+}
+
+// TestCreateOrUpdateBlocklist_ClearsStaleTemp ensures a temp set left behind by a
+// previously crashed run is discarded rather than merged into the new set.
+func TestCreateOrUpdateBlocklist_ClearsStaleTemp(t *testing.T) {
+	rc, mr := newTestCache(t)
+	ctx := context.Background()
+
+	// Simulate a crashed prior run that left a partial temp set.
+	require.NoError(t, rc.client.SAdd(ctx, "blocklist:stale_temp", "garbage.com").Err())
+
+	require.NoError(t, rc.CreateOrUpdateBlocklist(ctx, "stale", []byte("real.com")))
+
+	members, err := rc.client.SMembers(ctx, "blocklist:stale").Result()
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"real.com"}, members)
+	assert.NotContains(t, members, "garbage.com")
+	assert.False(t, mr.Exists("blocklist:stale_temp"))
+}
diff --git a/blocklists/go.mod b/blocklists/go.mod
index bb00afcf..8f019e75 100644
--- a/blocklists/go.mod
+++ b/blocklists/go.mod
@@ -3,6 +3,7 @@ module github.com/ivpn/dns/blocklists
 go 1.25.8
 
 require (
+	github.com/alicebob/miniredis/v2 v2.38.0
 	github.com/getsentry/sentry-go v0.31.1
 	github.com/getsentry/sentry-go/zerolog v0.31.1
 	github.com/ivpn/dns/libs v0.0.0
@@ -36,6 +37,7 @@ require (
 	github.com/xdg-go/scram v1.1.2 // indirect
 	github.com/xdg-go/stringprep v1.0.4 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
+	github.com/yuin/gopher-lua v1.1.1 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	golang.org/x/crypto v0.36.0 // indirect
diff --git a/blocklists/go.sum b/blocklists/go.sum
index ecb5eb48..3156e007 100644
--- a/blocklists/go.sum
+++ b/blocklists/go.sum
@@ -2,6 +2,8 @@ github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/alicebob/miniredis/v2 v2.38.0 h1:nZAzCR+Lj+Vxk4ZXzm2NuKq2O33RXj1XxJ2e2uP9jiw=
+github.com/alicebob/miniredis/v2 v2.38.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
@@ -126,6 +128,8 @@ github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gi
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
+github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
 go.mongodb.org/mongo-driver v1.17.3 h1:TQyXhnsWfWtgAhMtOgtYHMTkZIfBTpMTsMnd9ZBeHxQ=
 go.mongodb.org/mongo-driver v1.17.3/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 h1:TT4fX+nBOA/+LUkobKGW1ydGcn+G3vRw9+g5HwCphpk=

From 4aa70e5e41c11b06285c3811a9e5d11284126174 Mon Sep 17 00:00:00 2001
From: Maciek <tomczukmaciej@gmail.com>
Date: Thu, 11 Jun 2026 11:01:15 +0200
Subject: [PATCH 08/15] fix(blocklists): stagger hourly schedules to avoid
 context-deadline burst

Signed-off-by: Maciek <tomczukmaciej@gmail.com>
---
 blocklists/sources/3rd_party/hagezi.json        | 10 +++++-----
 blocklists/sources/3rd_party/steven_black.json  |  2 +-
 blocklists/sources/categories/adult.json        |  4 ++--
 blocklists/sources/categories/clickbait.json    |  2 +-
 blocklists/sources/categories/crypto.json       |  6 +++---
 blocklists/sources/categories/dating.json       |  4 ++--
 blocklists/sources/categories/drugs.json        |  4 ++--
 blocklists/sources/categories/fraud.json        |  4 ++--
 blocklists/sources/categories/gambling.json     |  4 ++--
 blocklists/sources/categories/gaming.json       |  2 +-
 blocklists/sources/categories/piracy.json       |  6 +++---
 blocklists/sources/categories/social_media.json |  2 +-
 blocklists/sources/categories/vpn_bypass.json   |  4 ++--
 blocklists/sources/security/nrd.json            | 10 +++++-----
 blocklists/sources/security/tif.json            |  2 +-
 15 files changed, 33 insertions(+), 33 deletions(-)

diff --git a/blocklists/sources/3rd_party/hagezi.json b/blocklists/sources/3rd_party/hagezi.json
index eeb47a79..0ab318a5 100644
--- a/blocklists/sources/3rd_party/hagezi.json
+++ b/blocklists/sources/3rd_party/hagezi.json
@@ -9,7 +9,7 @@
     "kind": "general",
     "intensity": ["basic"],
     "tags": ["hagezi", "basic"],
-    "schedule": "@hourly"
+    "schedule": "2 * * * *"
   },
   {
     "blocklist_id": "hagezi_multi_normal",
@@ -21,7 +21,7 @@
     "kind": "general",
     "intensity": [],
     "tags": ["hagezi"],
-    "schedule": "@hourly"
+    "schedule": "6 * * * *"
   },
   {
     "blocklist_id": "hagezi_multi_pro",
@@ -33,7 +33,7 @@
     "kind": "general",
     "intensity": ["comprehensive"],
     "tags": ["hagezi", "comprehensive"],
-    "schedule": "@hourly"
+    "schedule": "10 * * * *"
   },
   {
     "blocklist_id": "hagezi_multi_pro_plus",
@@ -45,7 +45,7 @@
     "kind": "general",
     "intensity": [],
     "tags": ["hagezi"],
-    "schedule": "@hourly"
+    "schedule": "14 * * * *"
   },
   {
     "blocklist_id": "hagezi_multi_ultimate",
@@ -57,6 +57,6 @@
     "kind": "general",
     "intensity": ["restrictive"],
     "tags": ["hagezi", "restrictive"],
-    "schedule": "@hourly"
+    "schedule": "18 * * * *"
   }
 ]
diff --git a/blocklists/sources/3rd_party/steven_black.json b/blocklists/sources/3rd_party/steven_black.json
index 40b3b8c2..44c1b93c 100644
--- a/blocklists/sources/3rd_party/steven_black.json
+++ b/blocklists/sources/3rd_party/steven_black.json
@@ -9,6 +9,6 @@
     "kind": "general",
     "intensity": ["basic", "comprehensive", "restrictive"],
     "tags": ["steven_black", "basic", "ads", "malware"],
-    "schedule": "@hourly"
+    "schedule": "32 * * * *"
   }
 ]
diff --git a/blocklists/sources/categories/adult.json b/blocklists/sources/categories/adult.json
index 2f05048f..e56171b0 100644
--- a/blocklists/sources/categories/adult.json
+++ b/blocklists/sources/categories/adult.json
@@ -10,7 +10,7 @@
     "category": "adult",
     "intensity": ["comprehensive"],
     "tags": ["category", "adult", "hagezi"],
-    "schedule": "@hourly"
+    "schedule": "22 * * * *"
   },
   {
     "blocklist_id": "blp_porn",
@@ -22,7 +22,7 @@
     "kind": "category",
     "category": "adult",
     "tags": ["category", "adult", "blp"],
-    "schedule": "@hourly"
+    "schedule": "25 * * * *"
   },
   {
     "blocklist_id": "oisd_nsfw",
diff --git a/blocklists/sources/categories/clickbait.json b/blocklists/sources/categories/clickbait.json
index f20bbf55..476a1b87 100644
--- a/blocklists/sources/categories/clickbait.json
+++ b/blocklists/sources/categories/clickbait.json
@@ -9,6 +9,6 @@
     "kind": "category",
     "category": "clickbait",
     "tags": ["category", "clickbait", "blp"],
-    "schedule": "@hourly"
+    "schedule": "48 * * * *"
   }
 ]
diff --git a/blocklists/sources/categories/crypto.json b/blocklists/sources/categories/crypto.json
index 658ae49f..a1b7609b 100644
--- a/blocklists/sources/categories/crypto.json
+++ b/blocklists/sources/categories/crypto.json
@@ -9,7 +9,7 @@
     "kind": "category",
     "category": "crypto",
     "tags": ["category", "crypto", "blp"],
-    "schedule": "@hourly"
+    "schedule": "57 * * * *"
   },
   {
     "blocklist_id": "shadowwhisperer_crypto",
@@ -21,7 +21,7 @@
     "kind": "category",
     "category": "crypto",
     "tags": ["category", "crypto", "shadowwhisperer"],
-    "schedule": "@hourly"
+    "schedule": "46 * * * *"
   },
   {
     "blocklist_id": "ut1_cryptojacking",
@@ -33,6 +33,6 @@
     "kind": "category",
     "category": "crypto",
     "tags": ["category", "crypto", "ut1"],
-    "schedule": "@hourly"
+    "schedule": "40 * * * *"
   }
 ]
diff --git a/blocklists/sources/categories/dating.json b/blocklists/sources/categories/dating.json
index 2323ecbd..8838f6ee 100644
--- a/blocklists/sources/categories/dating.json
+++ b/blocklists/sources/categories/dating.json
@@ -9,7 +9,7 @@
     "kind": "category",
     "category": "dating",
     "tags": ["category", "dating", "ut1"],
-    "schedule": "@hourly"
+    "schedule": "36 * * * *"
   },
   {
     "blocklist_id": "shadowwhisperer_dating",
@@ -21,6 +21,6 @@
     "kind": "category",
     "category": "dating",
     "tags": ["category", "dating", "shadowwhisperer"],
-    "schedule": "@hourly"
+    "schedule": "42 * * * *"
   }
 ]
diff --git a/blocklists/sources/categories/drugs.json b/blocklists/sources/categories/drugs.json
index d900b735..6dc4b7d8 100644
--- a/blocklists/sources/categories/drugs.json
+++ b/blocklists/sources/categories/drugs.json
@@ -9,7 +9,7 @@
     "kind": "category",
     "category": "drugs",
     "tags": ["category", "drugs", "ut1"],
-    "schedule": "@hourly"
+    "schedule": "38 * * * *"
   },
   {
     "blocklist_id": "blp_drugs",
@@ -21,6 +21,6 @@
     "kind": "category",
     "category": "drugs",
     "tags": ["category", "drugs", "blp"],
-    "schedule": "@hourly"
+    "schedule": "33 * * * *"
   }
 ]
diff --git a/blocklists/sources/categories/fraud.json b/blocklists/sources/categories/fraud.json
index 633d471b..c306056b 100644
--- a/blocklists/sources/categories/fraud.json
+++ b/blocklists/sources/categories/fraud.json
@@ -9,7 +9,7 @@
     "kind": "category",
     "category": "fraud",
     "tags": ["category", "fraud", "blp"],
-    "schedule": "@hourly"
+    "schedule": "1 * * * *"
   },
   {
     "blocklist_id": "blp_scam",
@@ -21,6 +21,6 @@
     "kind": "category",
     "category": "fraud",
     "tags": ["category", "fraud", "blp"],
-    "schedule": "@hourly"
+    "schedule": "9 * * * *"
   }
 ]
diff --git a/blocklists/sources/categories/gambling.json b/blocklists/sources/categories/gambling.json
index 992188a1..71e64f74 100644
--- a/blocklists/sources/categories/gambling.json
+++ b/blocklists/sources/categories/gambling.json
@@ -9,7 +9,7 @@
     "kind": "category",
     "category": "gambling",
     "tags": ["category", "gambling", "hagezi"],
-    "schedule": "@hourly"
+    "schedule": "24 * * * *"
   },
   {
     "blocklist_id": "blp_gambling",
@@ -21,6 +21,6 @@
     "kind": "category",
     "category": "gambling",
     "tags": ["category", "gambling", "blp"],
-    "schedule": "@hourly"
+    "schedule": "17 * * * *"
   }
 ]
diff --git a/blocklists/sources/categories/gaming.json b/blocklists/sources/categories/gaming.json
index e756f456..ced7c5a6 100644
--- a/blocklists/sources/categories/gaming.json
+++ b/blocklists/sources/categories/gaming.json
@@ -9,6 +9,6 @@
     "kind": "category",
     "category": "gaming",
     "tags": ["category", "gaming", "ut1"],
-    "schedule": "@hourly"
+    "schedule": "34 * * * *"
   }
 ]
diff --git a/blocklists/sources/categories/piracy.json b/blocklists/sources/categories/piracy.json
index 7dc9a642..f9e530a3 100644
--- a/blocklists/sources/categories/piracy.json
+++ b/blocklists/sources/categories/piracy.json
@@ -9,7 +9,7 @@
     "kind": "category",
     "category": "piracy",
     "tags": ["category", "piracy", "hagezi"],
-    "schedule": "@hourly"
+    "schedule": "28 * * * *"
   },
   {
     "blocklist_id": "blp_piracy",
@@ -21,7 +21,7 @@
     "kind": "category",
     "category": "piracy",
     "tags": ["category", "piracy", "blp"],
-    "schedule": "@hourly"
+    "schedule": "41 * * * *"
   },
   {
     "blocklist_id": "blp_torrent",
@@ -33,6 +33,6 @@
     "kind": "category",
     "category": "piracy",
     "tags": ["category", "piracy", "blp"],
-    "schedule": "@hourly"
+    "schedule": "49 * * * *"
   }
 ]
diff --git a/blocklists/sources/categories/social_media.json b/blocklists/sources/categories/social_media.json
index 0c909814..0f31f71f 100644
--- a/blocklists/sources/categories/social_media.json
+++ b/blocklists/sources/categories/social_media.json
@@ -9,6 +9,6 @@
     "kind": "category",
     "category": "social_media",
     "tags": ["category", "social_media", "hagezi"],
-    "schedule": "@hourly"
+    "schedule": "30 * * * *"
   }
 ]
diff --git a/blocklists/sources/categories/vpn_bypass.json b/blocklists/sources/categories/vpn_bypass.json
index 0302910a..76aad145 100644
--- a/blocklists/sources/categories/vpn_bypass.json
+++ b/blocklists/sources/categories/vpn_bypass.json
@@ -9,7 +9,7 @@
     "kind": "category",
     "category": "vpn_bypass",
     "tags": ["category", "vpn_bypass", "hagezi"],
-    "schedule": "@hourly"
+    "schedule": "26 * * * *"
   },
   {
     "blocklist_id": "shadowwhisperer_tunnels",
@@ -21,6 +21,6 @@
     "kind": "category",
     "category": "vpn_bypass",
     "tags": ["category", "vpn_bypass", "shadowwhisperer"],
-    "schedule": "@hourly"
+    "schedule": "44 * * * *"
   }
 ]
diff --git a/blocklists/sources/security/nrd.json b/blocklists/sources/security/nrd.json
index 3cd0f926..29171406 100644
--- a/blocklists/sources/security/nrd.json
+++ b/blocklists/sources/security/nrd.json
@@ -8,7 +8,7 @@
     "syntax": "domains",
     "kind": "security",
     "tags": ["security", "hagezi", "nrd"],
-    "schedule": "@hourly",
+    "schedule": "0 * * * *",
     "default": false
   },
   {
@@ -20,7 +20,7 @@
     "syntax": "domains",
     "kind": "security",
     "tags": ["security", "hagezi", "nrd"],
-    "schedule": "@hourly",
+    "schedule": "4 * * * *",
     "default": false
   },
   {
@@ -32,7 +32,7 @@
     "syntax": "domains",
     "kind": "security",
     "tags": ["security", "hagezi", "nrd"],
-    "schedule": "@hourly",
+    "schedule": "8 * * * *",
     "default": false
   },
   {
@@ -44,7 +44,7 @@
     "syntax": "domains",
     "kind": "security",
     "tags": ["security", "hagezi", "nrd"],
-    "schedule": "@hourly",
+    "schedule": "12 * * * *",
     "default": false
   },
   {
@@ -56,7 +56,7 @@
     "syntax": "domains",
     "kind": "security",
     "tags": ["security", "hagezi", "nrd"],
-    "schedule": "@hourly",
+    "schedule": "16 * * * *",
     "default": false
   }
 ]
diff --git a/blocklists/sources/security/tif.json b/blocklists/sources/security/tif.json
index 3c3c6c1c..eec630e3 100644
--- a/blocklists/sources/security/tif.json
+++ b/blocklists/sources/security/tif.json
@@ -9,7 +9,7 @@
     "kind": "security",
     "intensity": ["comprehensive", "restrictive"],
     "tags": ["comprehensive"],
-    "schedule": "@hourly",
+    "schedule": "20 * * * *",
     "default": true
   }
 ]

From 8536871af5aab7e7620a9722102bef56980fd7a1 Mon Sep 17 00:00:00 2001
From: Maciek <tomczukmaciej@gmail.com>
Date: Thu, 11 Jun 2026 11:01:53 +0200
Subject: [PATCH 09/15] fix(blocklists): raise per-blocklist processing timeout
 to 2m

Signed-off-by: Maciek <tomczukmaciej@gmail.com>
---
 blocklists/service/blocklists.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/blocklists/service/blocklists.go b/blocklists/service/blocklists.go
index 0f7a47d5..63a4acd2 100644
--- a/blocklists/service/blocklists.go
+++ b/blocklists/service/blocklists.go
@@ -22,7 +22,7 @@ import (
 
 const (
 	jsonExt           = ".json"
-	processingTimeout = 1 * time.Minute
+	processingTimeout = 2 * time.Minute
 )
 
 // errDownloadTooLarge signals that a source's response body exceeded the

From 9c764243631be8947e683a894f9884da62dcbffe Mon Sep 17 00:00:00 2001
From: Maciek <tomczukmaciej@gmail.com>
Date: Thu, 11 Jun 2026 13:31:26 +0200
Subject: [PATCH 10/15] feat(blocklists): add CERT.pl warning list to Security

Signed-off-by: Maciek <tomczukmaciej@gmail.com>
---
 blocklists/internal/extractor/extractor.go      |  2 ++
 blocklists/internal/extractor/extractor_test.go |  6 ++++++
 blocklists/sources/security/certpl.json         | 14 ++++++++++++++
 3 files changed, 22 insertions(+)
 create mode 100644 blocklists/sources/security/certpl.json

diff --git a/blocklists/internal/extractor/extractor.go b/blocklists/internal/extractor/extractor.go
index efbf7abc..62f4ab7c 100644
--- a/blocklists/internal/extractor/extractor.go
+++ b/blocklists/internal/extractor/extractor.go
@@ -45,6 +45,8 @@ func NewExtractor(blocklistID string) (Extractor, error) {
 		return NewDomainsExtractor(), nil
 	case strings.HasPrefix(blocklistID, "1hosts_"):
 		return NewDomainsExtractor(), nil
+	case strings.HasPrefix(blocklistID, "certpl_"):
+		return NewDomainsExtractor(), nil
 	default:
 		log.Error().Msg("Unknown blocklist ID")
 		return nil, fmt.Errorf("unknown blocklist ID: %s", blocklistID)
diff --git a/blocklists/internal/extractor/extractor_test.go b/blocklists/internal/extractor/extractor_test.go
index 6945400c..6594f6e4 100644
--- a/blocklists/internal/extractor/extractor_test.go
+++ b/blocklists/internal/extractor/extractor_test.go
@@ -79,6 +79,12 @@ func TestNewExtractor(t *testing.T) {
 			wantType:    "*extractor.DomainsExtractor",
 			wantErr:     false,
 		},
+		{
+			name:        "certpl extractor",
+			blocklistID: "certpl_warning_list",
+			wantType:    "*extractor.DomainsExtractor",
+			wantErr:     false,
+		},
 		{
 			name:        "unknown extractor",
 			blocklistID: "unknown_type",
diff --git a/blocklists/sources/security/certpl.json b/blocklists/sources/security/certpl.json
new file mode 100644
index 00000000..71cbf14d
--- /dev/null
+++ b/blocklists/sources/security/certpl.json
@@ -0,0 +1,14 @@
+[
+  {
+    "blocklist_id": "certpl_warning_list",
+    "name": "CERT.pl Warning List",
+    "description": "Warning list of malicious domains (phishing, scam and malware) maintained by CERT Polska (CSIRT NASK), the Polish national CERT. Domains used in attacks targeting users are sinkholed; entries auto-expire after six months.",
+    "source_url": "https://hole.cert.pl/domains/v2/domains.txt",
+    "homepage": "https://cert.pl/en/warning-list/",
+    "syntax": "domains",
+    "kind": "security",
+    "tags": ["security", "certpl", "phishing"],
+    "schedule": "50 * * * *",
+    "default": false
+  }
+]

From 3adba40e54e11dfbf915dc6e740c7928b9a9e740 Mon Sep 17 00:00:00 2001
From: Maciek <tomczukmaciej@gmail.com>
Date: Fri, 12 Jun 2026 13:00:47 +0200
Subject: [PATCH 11/15] feat(api): add per-profile DNS rebinding protection
 setting

Signed-off-by: Maciek <tomczukmaciej@gmail.com>
---
 api/cache/redis.go                            | 12 +++
 api/docs/docs.go                              | 12 +++
 api/docs/swagger.json                         | 12 +++
 api/docs/swagger.yaml                         |  8 ++
 api/model/profile.go                          |  2 +-
 api/model/profile_settings.go                 |  3 +
 api/model/security.go                         | 10 ++-
 api/service/profile/service.go                | 29 +++++++
 api/service/profile/service_test.go           | 49 +++++++++++
 app/src/api/client/api.ts                     | 20 +++++
 tests/moddns_client/.openapi-generator/FILES  |  1 +
 tests/moddns_client/README.md                 |  1 +
 tests/moddns_client/moddns/__init__.py        |  1 +
 tests/moddns_client/moddns/models/__init__.py |  1 +
 .../moddns/models/model_profile_update.py     |  4 +-
 .../models/model_rebinding_protection.py      | 87 +++++++++++++++++++
 .../moddns/models/model_security.py           | 12 ++-
 17 files changed, 257 insertions(+), 7 deletions(-)
 create mode 100644 tests/moddns_client/moddns/models/model_rebinding_protection.py

diff --git a/api/cache/redis.go b/api/cache/redis.go
index 92fcab02..8e6cfa01 100644
--- a/api/cache/redis.go
+++ b/api/cache/redis.go
@@ -206,6 +206,18 @@ func (c *RedisCache) CreateOrUpdateProfileSettings(ctx context.Context, settings
 		return err
 	}
 
+	// add security rebinding protection settings
+	rebindingSettings := fmt.Sprintf("settings:%s:%s:%s", settings.ProfileId, "security", "rebinding_protection")
+	securityRebindingCmd := rdp.HSet(ctx, rebindingSettings, settings.Security.RebindingProtection)
+	if err := securityRebindingCmd.Err(); err != nil {
+		log.Err(err).Msg("Cache: failed to create security rebinding protection settings")
+		if rollback {
+			log.Warn().Msg("Cache: rolling back security rebinding protection settings")
+			rdp.Del(ctx, rebindingSettings)
+		}
+		return err
+	}
+
 	// add advanced settings
 	advancedSettings := fmt.Sprintf("settings:%s:%s", settings.ProfileId, "advanced")
 	advancedCmd := rdp.HSet(ctx, advancedSettings, settings.Advanced)
diff --git a/api/docs/docs.go b/api/docs/docs.go
index 251dcc36..aa54c856 100644
--- a/api/docs/docs.go
+++ b/api/docs/docs.go
@@ -2982,6 +2982,7 @@ const docTemplate = `{
                         "/settings/privacy/custom_rules_subdomains_rule",
                         "/settings/security/dnssec/enabled",
                         "/settings/security/dnssec/send_do_bit",
+                        "/settings/security/rebinding_protection/enabled",
                         "/settings/advanced/recursor"
                     ]
                 },
@@ -3023,6 +3024,14 @@ const docTemplate = `{
                 }
             }
         },
+        "model.RebindingProtection": {
+            "type": "object",
+            "properties": {
+                "enabled": {
+                    "type": "boolean"
+                }
+            }
+        },
         "model.Retention": {
             "type": "string",
             "enum": [
@@ -3048,6 +3057,9 @@ const docTemplate = `{
             "properties": {
                 "dnssec": {
                     "$ref": "#/definitions/model.DNSSECSettings"
+                },
+                "rebinding_protection": {
+                    "$ref": "#/definitions/model.RebindingProtection"
                 }
             }
         },
diff --git a/api/docs/swagger.json b/api/docs/swagger.json
index 7628f07a..210e2d86 100644
--- a/api/docs/swagger.json
+++ b/api/docs/swagger.json
@@ -2974,6 +2974,7 @@
                         "/settings/privacy/custom_rules_subdomains_rule",
                         "/settings/security/dnssec/enabled",
                         "/settings/security/dnssec/send_do_bit",
+                        "/settings/security/rebinding_protection/enabled",
                         "/settings/advanced/recursor"
                     ]
                 },
@@ -3015,6 +3016,14 @@
                 }
             }
         },
+        "model.RebindingProtection": {
+            "type": "object",
+            "properties": {
+                "enabled": {
+                    "type": "boolean"
+                }
+            }
+        },
         "model.Retention": {
             "type": "string",
             "enum": [
@@ -3040,6 +3049,9 @@
             "properties": {
                 "dnssec": {
                     "$ref": "#/definitions/model.DNSSECSettings"
+                },
+                "rebinding_protection": {
+                    "$ref": "#/definitions/model.RebindingProtection"
                 }
             }
         },
diff --git a/api/docs/swagger.yaml b/api/docs/swagger.yaml
index 64e63767..28dea80d 100644
--- a/api/docs/swagger.yaml
+++ b/api/docs/swagger.yaml
@@ -389,6 +389,7 @@ definitions:
         - /settings/privacy/custom_rules_subdomains_rule
         - /settings/security/dnssec/enabled
         - /settings/security/dnssec/send_do_bit
+        - /settings/security/rebinding_protection/enabled
         - /settings/advanced/recursor
         type: string
       value: {}
@@ -420,6 +421,11 @@ definitions:
       timestamp:
         type: string
     type: object
+  model.RebindingProtection:
+    properties:
+      enabled:
+        type: boolean
+    type: object
   model.Retention:
     enum:
     - 1h
@@ -438,6 +444,8 @@ definitions:
     properties:
       dnssec:
         $ref: '#/definitions/model.DNSSECSettings'
+      rebinding_protection:
+        $ref: '#/definitions/model.RebindingProtection'
     required:
     - dnssec
     type: object
diff --git a/api/model/profile.go b/api/model/profile.go
index 768baca4..ff7b4fc1 100644
--- a/api/model/profile.go
+++ b/api/model/profile.go
@@ -32,6 +32,6 @@ func NewProfile(idGen idgen.Generator, name, accountId string) (*Profile, error)
 // RFC6902 JSON Patch format is used
 type ProfileUpdate struct {
 	Operation string `json:"operation" validate:"required,oneof=remove add replace move copy"`
-	Path      string `json:"path" validate:"required,oneof=/name /settings/statistics/enabled /settings/logs/enabled /settings/logs/log_clients_ips /settings/logs/log_domains /settings/logs/retention /settings/privacy/default_rule /settings/privacy/blocklists_subdomains_rule /settings/privacy/custom_rules_subdomains_rule /settings/security/dnssec/enabled /settings/security/dnssec/send_do_bit /settings/advanced/recursor"`
+	Path      string `json:"path" validate:"required,oneof=/name /settings/statistics/enabled /settings/logs/enabled /settings/logs/log_clients_ips /settings/logs/log_domains /settings/logs/retention /settings/privacy/default_rule /settings/privacy/blocklists_subdomains_rule /settings/privacy/custom_rules_subdomains_rule /settings/security/dnssec/enabled /settings/security/dnssec/send_do_bit /settings/security/rebinding_protection/enabled /settings/advanced/recursor"`
 	Value     any    `json:"value" validate:"required"`
 }
diff --git a/api/model/profile_settings.go b/api/model/profile_settings.go
index b97c3504..f9e470b2 100644
--- a/api/model/profile_settings.go
+++ b/api/model/profile_settings.go
@@ -59,6 +59,9 @@ func NewSettings() *ProfileSettings {
 				Enabled:   true,
 				SendDoBit: false,
 			},
+			RebindingProtection: RebindingProtection{
+				Enabled: false,
+			},
 		},
 		Logs: &LogsSettings{
 			Enabled:       false,
diff --git a/api/model/security.go b/api/model/security.go
index 8ff60ac7..7bc59ddf 100644
--- a/api/model/security.go
+++ b/api/model/security.go
@@ -2,10 +2,18 @@ package model
 
 // Security represents security settings
 type Security struct {
-	DNSSECSettings DNSSECSettings `json:"dnssec" bson:"dnssec" redis:"dnssec" binding:"required"`
+	DNSSECSettings      DNSSECSettings      `json:"dnssec" bson:"dnssec" redis:"dnssec" binding:"required"`
+	RebindingProtection RebindingProtection `json:"rebinding_protection" bson:"rebinding_protection" redis:"rebinding_protection"`
 }
 
 type DNSSECSettings struct {
 	Enabled   bool `json:"enabled" bson:"enabled" redis:"enabled" binding:"required"`
 	SendDoBit bool `json:"send_do_bit" bson:"send_do_bit" redis:"send_do_bit" binding:"required"`
 }
+
+// RebindingProtection holds the per-profile DNS rebinding protection toggle.
+// When enabled, the proxy blocks answers where a public name resolves to a
+// private/loopback/link-local IP. Default off (opt-in).
+type RebindingProtection struct {
+	Enabled bool `json:"enabled" bson:"enabled" redis:"enabled"`
+}
diff --git a/api/service/profile/service.go b/api/service/profile/service.go
index 9d8f87ac..afeb1e7a 100644
--- a/api/service/profile/service.go
+++ b/api/service/profile/service.go
@@ -258,6 +258,12 @@ func (p *ProfileService) UpdateProfile(ctx context.Context, accountId, profileId
 			}
 		}
 
+		if strings.Contains(update.Path, "/settings/security/rebinding_protection/") {
+			if err = p.handleRebindingProtectionUpdate(profile, update.Path, update); err != nil {
+				return nil, err
+			}
+		}
+
 		if strings.Contains(update.Path, "/settings/advanced/") {
 			if err = p.handleAdvancedSettingsUpdate(profile, update.Path, update); err != nil {
 				return nil, err
@@ -501,6 +507,29 @@ func (p *ProfileService) handleDNSSECSettingsUpdate(profile *model.Profile, upda
 	return nil
 }
 
+func (p *ProfileService) handleRebindingProtectionUpdate(profile *model.Profile, updatePath string, update model.ProfileUpdate) error {
+	switch updatePath { // nolint
+	case "/settings/security/rebinding_protection/enabled":
+		return p.updateRebindingProtectionEnabled(profile, update)
+	}
+
+	return nil
+}
+
+func (p *ProfileService) updateRebindingProtectionEnabled(profile *model.Profile, update model.ProfileUpdate) (err error) {
+	var enabled bool
+	switch update.Operation { // nolint
+	case model.UpdateOperationReplace:
+		enabled, err = cast.ToBoolE(update.Value)
+		if err != nil {
+			return err
+		}
+		profile.Settings.Security.RebindingProtection.Enabled = enabled
+	}
+
+	return nil
+}
+
 func (p *ProfileService) handleAdvancedSettingsUpdate(profile *model.Profile, updatePath string, update model.ProfileUpdate) error {
 	switch updatePath { // nolint
 	case "/settings/advanced/recursor":
diff --git a/api/service/profile/service_test.go b/api/service/profile/service_test.go
index fc667f3d..25e5a408 100644
--- a/api/service/profile/service_test.go
+++ b/api/service/profile/service_test.go
@@ -1004,6 +1004,55 @@ func (suite *ProfileTestSuite) TestUpdateProfile() {
 			expectedError: "",
 			expectProfile: true,
 		},
+		// Rebinding protection settings tests. specRef: G18 (api-endpoint-behaviour.md)
+		{
+			name:      "Successfully update rebinding_protection enabled",
+			profileID: "profile123",
+			accountID: "account123",
+			updates: []model.ProfileUpdate{
+				{
+					Operation: model.UpdateOperationReplace,
+					Path:      "/settings/security/rebinding_protection/enabled",
+					Value:     true,
+				},
+			},
+			existingProfile: &model.Profile{
+				ProfileId: "profile123",
+				AccountId: "account123",
+				Name:      "Test Profile",
+				Settings: &model.ProfileSettings{
+					Security: &model.Security{
+						RebindingProtection: model.RebindingProtection{Enabled: false},
+					},
+				},
+			},
+			expectedError: "",
+			expectProfile: true,
+		},
+		{
+			name:      "Update rebinding_protection enabled with invalid value",
+			profileID: "profile123",
+			accountID: "account123",
+			updates: []model.ProfileUpdate{
+				{
+					Operation: model.UpdateOperationReplace,
+					Path:      "/settings/security/rebinding_protection/enabled",
+					Value:     "not_a_bool",
+				},
+			},
+			existingProfile: &model.Profile{
+				ProfileId: "profile123",
+				AccountId: "account123",
+				Name:      "Test Profile",
+				Settings: &model.ProfileSettings{
+					Security: &model.Security{
+						RebindingProtection: model.RebindingProtection{Enabled: false},
+					},
+				},
+			},
+			expectedError: "parsing",
+			expectProfile: false,
+		},
 		{
 			name:      "Update DNSSEC enabled with invalid value",
 			profileID: "profile123",
diff --git a/app/src/api/client/api.ts b/app/src/api/client/api.ts
index d9a39f03..e6667e95 100644
--- a/app/src/api/client/api.ts
+++ b/app/src/api/client/api.ts
@@ -788,6 +788,7 @@ export const ModelProfileUpdatePathEnum = {
     SettingsPrivacyCustomRulesSubdomainsRule: '/settings/privacy/custom_rules_subdomains_rule',
     SettingsSecurityDnssecEnabled: '/settings/security/dnssec/enabled',
     SettingsSecurityDnssecSendDoBit: '/settings/security/dnssec/send_do_bit',
+    SettingsSecurityRebindingProtectionEnabled: '/settings/security/rebinding_protection/enabled',
     SettingsAdvancedRecursor: '/settings/advanced/recursor'
 } as const;
 
@@ -854,6 +855,19 @@ export interface ModelQueryLog {
      */
     'timestamp'?: string;
 }
+/**
+ * 
+ * @export
+ * @interface ModelRebindingProtection
+ */
+export interface ModelRebindingProtection {
+    /**
+     * 
+     * @type {boolean}
+     * @memberof ModelRebindingProtection
+     */
+    'enabled'?: boolean;
+}
 /**
  * 
  * @export
@@ -883,6 +897,12 @@ export interface ModelSecurity {
      * @memberof ModelSecurity
      */
     'dnssec': ModelDNSSECSettings;
+    /**
+     * 
+     * @type {ModelRebindingProtection}
+     * @memberof ModelSecurity
+     */
+    'rebinding_protection'?: ModelRebindingProtection;
 }
 /**
  * 
diff --git a/tests/moddns_client/.openapi-generator/FILES b/tests/moddns_client/.openapi-generator/FILES
index bdd31a59..d5eb18ca 100644
--- a/tests/moddns_client/.openapi-generator/FILES
+++ b/tests/moddns_client/.openapi-generator/FILES
@@ -52,6 +52,7 @@ moddns/models/model_profile.py
 moddns/models/model_profile_settings.py
 moddns/models/model_profile_update.py
 moddns/models/model_query_log.py
+moddns/models/model_rebinding_protection.py
 moddns/models/model_retention.py
 moddns/models/model_security.py
 moddns/models/model_statistics_aggregated.py
diff --git a/tests/moddns_client/README.md b/tests/moddns_client/README.md
index a0dda1be..7431182e 100644
--- a/tests/moddns_client/README.md
+++ b/tests/moddns_client/README.md
@@ -165,6 +165,7 @@ Class | Method | HTTP request | Description
  - [ModelProfileSettings](docs/ModelProfileSettings.md)
  - [ModelProfileUpdate](docs/ModelProfileUpdate.md)
  - [ModelQueryLog](docs/ModelQueryLog.md)
+ - [ModelRebindingProtection](docs/ModelRebindingProtection.md)
  - [ModelRetention](docs/ModelRetention.md)
  - [ModelSecurity](docs/ModelSecurity.md)
  - [ModelStatisticsAggregated](docs/ModelStatisticsAggregated.md)
diff --git a/tests/moddns_client/moddns/__init__.py b/tests/moddns_client/moddns/__init__.py
index 13ef6bc3..fc4e2237 100644
--- a/tests/moddns_client/moddns/__init__.py
+++ b/tests/moddns_client/moddns/__init__.py
@@ -70,6 +70,7 @@
 from moddns.models.model_profile_settings import ModelProfileSettings
 from moddns.models.model_profile_update import ModelProfileUpdate
 from moddns.models.model_query_log import ModelQueryLog
+from moddns.models.model_rebinding_protection import ModelRebindingProtection
 from moddns.models.model_retention import ModelRetention
 from moddns.models.model_security import ModelSecurity
 from moddns.models.model_statistics_aggregated import ModelStatisticsAggregated
diff --git a/tests/moddns_client/moddns/models/__init__.py b/tests/moddns_client/moddns/models/__init__.py
index 81db4d15..daba96c0 100644
--- a/tests/moddns_client/moddns/models/__init__.py
+++ b/tests/moddns_client/moddns/models/__init__.py
@@ -41,6 +41,7 @@
 from moddns.models.model_profile_settings import ModelProfileSettings
 from moddns.models.model_profile_update import ModelProfileUpdate
 from moddns.models.model_query_log import ModelQueryLog
+from moddns.models.model_rebinding_protection import ModelRebindingProtection
 from moddns.models.model_retention import ModelRetention
 from moddns.models.model_security import ModelSecurity
 from moddns.models.model_statistics_aggregated import ModelStatisticsAggregated
diff --git a/tests/moddns_client/moddns/models/model_profile_update.py b/tests/moddns_client/moddns/models/model_profile_update.py
index 5ed5309d..a0d4c4e3 100644
--- a/tests/moddns_client/moddns/models/model_profile_update.py
+++ b/tests/moddns_client/moddns/models/model_profile_update.py
@@ -41,8 +41,8 @@ def operation_validate_enum(cls, value):
     @field_validator('path')
     def path_validate_enum(cls, value):
         """Validates the enum"""
-        if value not in set(['/name', '/settings/statistics/enabled', '/settings/logs/enabled', '/settings/logs/log_clients_ips', '/settings/logs/log_domains', '/settings/logs/retention', '/settings/privacy/default_rule', '/settings/privacy/blocklists_subdomains_rule', '/settings/privacy/custom_rules_subdomains_rule', '/settings/security/dnssec/enabled', '/settings/security/dnssec/send_do_bit', '/settings/advanced/recursor']):
-            raise ValueError("must be one of enum values ('/name', '/settings/statistics/enabled', '/settings/logs/enabled', '/settings/logs/log_clients_ips', '/settings/logs/log_domains', '/settings/logs/retention', '/settings/privacy/default_rule', '/settings/privacy/blocklists_subdomains_rule', '/settings/privacy/custom_rules_subdomains_rule', '/settings/security/dnssec/enabled', '/settings/security/dnssec/send_do_bit', '/settings/advanced/recursor')")
+        if value not in set(['/name', '/settings/statistics/enabled', '/settings/logs/enabled', '/settings/logs/log_clients_ips', '/settings/logs/log_domains', '/settings/logs/retention', '/settings/privacy/default_rule', '/settings/privacy/blocklists_subdomains_rule', '/settings/privacy/custom_rules_subdomains_rule', '/settings/security/dnssec/enabled', '/settings/security/dnssec/send_do_bit', '/settings/security/rebinding_protection/enabled', '/settings/advanced/recursor']):
+            raise ValueError("must be one of enum values ('/name', '/settings/statistics/enabled', '/settings/logs/enabled', '/settings/logs/log_clients_ips', '/settings/logs/log_domains', '/settings/logs/retention', '/settings/privacy/default_rule', '/settings/privacy/blocklists_subdomains_rule', '/settings/privacy/custom_rules_subdomains_rule', '/settings/security/dnssec/enabled', '/settings/security/dnssec/send_do_bit', '/settings/security/rebinding_protection/enabled', '/settings/advanced/recursor')")
         return value
 
     model_config = ConfigDict(
diff --git a/tests/moddns_client/moddns/models/model_rebinding_protection.py b/tests/moddns_client/moddns/models/model_rebinding_protection.py
new file mode 100644
index 00000000..49749fd2
--- /dev/null
+++ b/tests/moddns_client/moddns/models/model_rebinding_protection.py
@@ -0,0 +1,87 @@
+# coding: utf-8
+
+"""
+    modDNS REST API
+
+    modDNS REST API
+
+    The version of the OpenAPI document: 1.0
+    Generated by OpenAPI Generator (https://openapi-generator.tech)
+
+    Do not edit the class manually.
+"""  # noqa: E501
+
+
+from __future__ import annotations
+import pprint
+import re  # noqa: F401
+import json
+
+from pydantic import BaseModel, ConfigDict, StrictBool
+from typing import Any, ClassVar, Dict, List, Optional
+from typing import Optional, Set
+from typing_extensions import Self
+
+class ModelRebindingProtection(BaseModel):
+    """
+    ModelRebindingProtection
+    """ # noqa: E501
+    enabled: Optional[StrictBool] = None
+    __properties: ClassVar[List[str]] = ["enabled"]
+
+    model_config = ConfigDict(
+        populate_by_name=True,
+        validate_assignment=True,
+        protected_namespaces=(),
+    )
+
+
+    def to_str(self) -> str:
+        """Returns the string representation of the model using alias"""
+        return pprint.pformat(self.model_dump(by_alias=True))
+
+    def to_json(self) -> str:
+        """Returns the JSON representation of the model using alias"""
+        # TODO: pydantic v2: use .model_dump_json(by_alias=True, exclude_unset=True) instead
+        return json.dumps(self.to_dict())
+
+    @classmethod
+    def from_json(cls, json_str: str) -> Optional[Self]:
+        """Create an instance of ModelRebindingProtection from a JSON string"""
+        return cls.from_dict(json.loads(json_str))
+
+    def to_dict(self) -> Dict[str, Any]:
+        """Return the dictionary representation of the model using alias.
+
+        This has the following differences from calling pydantic's
+        `self.model_dump(by_alias=True)`:
+
+        * `None` is only added to the output dict for nullable fields that
+          were set at model initialization. Other fields with value `None`
+          are ignored.
+        """
+        excluded_fields: Set[str] = set([
+        ])
+
+        _dict = self.model_dump(
+            by_alias=True,
+            exclude=excluded_fields,
+            exclude_none=True,
+        )
+        return _dict
+
+    @classmethod
+    def from_dict(cls, obj: Optional[Dict[str, Any]]) -> Optional[Self]:
+        """Create an instance of ModelRebindingProtection from a dict"""
+        if obj is None:
+            return None
+
+        if not isinstance(obj, dict):
+            return cls.model_validate(obj)
+
+        _obj = cls.model_validate({
+            "enabled": obj.get("enabled")
+        })
+        return _obj
+
+
diff --git a/tests/moddns_client/moddns/models/model_security.py b/tests/moddns_client/moddns/models/model_security.py
index 0182d1ca..5dfcd479 100644
--- a/tests/moddns_client/moddns/models/model_security.py
+++ b/tests/moddns_client/moddns/models/model_security.py
@@ -18,8 +18,9 @@
 import json
 
 from pydantic import BaseModel, ConfigDict
-from typing import Any, ClassVar, Dict, List
+from typing import Any, ClassVar, Dict, List, Optional
 from moddns.models.model_dnssec_settings import ModelDNSSECSettings
+from moddns.models.model_rebinding_protection import ModelRebindingProtection
 from typing import Optional, Set
 from typing_extensions import Self
 
@@ -28,7 +29,8 @@ class ModelSecurity(BaseModel):
     ModelSecurity
     """ # noqa: E501
     dnssec: ModelDNSSECSettings
-    __properties: ClassVar[List[str]] = ["dnssec"]
+    rebinding_protection: Optional[ModelRebindingProtection] = None
+    __properties: ClassVar[List[str]] = ["dnssec", "rebinding_protection"]
 
     model_config = ConfigDict(
         populate_by_name=True,
@@ -72,6 +74,9 @@ def to_dict(self) -> Dict[str, Any]:
         # override the default output from pydantic by calling `to_dict()` of dnssec
         if self.dnssec:
             _dict['dnssec'] = self.dnssec.to_dict()
+        # override the default output from pydantic by calling `to_dict()` of rebinding_protection
+        if self.rebinding_protection:
+            _dict['rebinding_protection'] = self.rebinding_protection.to_dict()
         return _dict
 
     @classmethod
@@ -84,7 +89,8 @@ def from_dict(cls, obj: Optional[Dict[str, Any]]) -> Optional[Self]:
             return cls.model_validate(obj)
 
         _obj = cls.model_validate({
-            "dnssec": ModelDNSSECSettings.from_dict(obj["dnssec"]) if obj.get("dnssec") is not None else None
+            "dnssec": ModelDNSSECSettings.from_dict(obj["dnssec"]) if obj.get("dnssec") is not None else None,
+            "rebinding_protection": ModelRebindingProtection.from_dict(obj["rebinding_protection"]) if obj.get("rebinding_protection") is not None else None
         })
         return _obj
 

From 30a6f497c959ce8ba6d0adb9e1766b4a5ecdb3ae Mon Sep 17 00:00:00 2001
From: Maciek <tomczukmaciej@gmail.com>
Date: Fri, 12 Jun 2026 13:26:58 +0200
Subject: [PATCH 12/15] feat(proxy): block DNS rebinding via IP-phase filter
 (tier 150)

Signed-off-by: Maciek <tomczukmaciej@gmail.com>
---
 proxy/cache/memory/serialization_test.go      |   2 +
 proxy/cache/redis.go                          |  18 +-
 proxy/config/config.go                        |  38 +++++
 proxy/filter/aggregate.go                     |   1 +
 proxy/filter/cross_phase_aggregation_test.go  |  61 ++++++-
 proxy/filter/ip.go                            |   6 +-
 proxy/filter/ip_custom_rules_asn_test.go      |   4 +-
 .../filter/ip_custom_rules_precedence_test.go |   2 +-
 proxy/filter/ip_custom_rules_test.go          |   4 +-
 proxy/filter/rebinding.go                     |  92 ++++++++++
 proxy/filter/rebinding_benchmark_test.go      |  69 ++++++++
 proxy/filter/rebinding_ranges.go              |  73 ++++++++
 proxy/filter/rebinding_test.go                | 161 ++++++++++++++++++
 proxy/filter/services_test.go                 |  10 +-
 proxy/model/profile_settings.go               |  18 +-
 proxy/requestcontext/logging_gating_test.go   |   3 +
 proxy/requestcontext/request_context.go       |  44 ++---
 proxy/server/server.go                        |   8 +-
 proxy/server/strict_no_logging_test.go        |   2 +
 19 files changed, 565 insertions(+), 51 deletions(-)
 create mode 100644 proxy/filter/rebinding.go
 create mode 100644 proxy/filter/rebinding_benchmark_test.go
 create mode 100644 proxy/filter/rebinding_ranges.go
 create mode 100644 proxy/filter/rebinding_test.go

diff --git a/proxy/cache/memory/serialization_test.go b/proxy/cache/memory/serialization_test.go
index b77a4053..2891feb1 100644
--- a/proxy/cache/memory/serialization_test.go
+++ b/proxy/cache/memory/serialization_test.go
@@ -31,6 +31,7 @@ func TestRequestContextSerialization(t *testing.T) {
 		map[string]string{"privacy": "setting"},
 		map[string]string{"logs": "setting"},
 		map[string]string{"dnssec": "enabled"},
+		map[string]string{"enabled": "false"},
 		map[string]string{"advanced": "setting"},
 		logger,
 	)
@@ -89,6 +90,7 @@ func TestRequestContextSerializationWithEnabledLogger(t *testing.T) {
 		map[string]string{"privacy": "setting"},
 		map[string]string{"logs": "setting"},
 		map[string]string{"dnssec": "enabled"},
+		map[string]string{"enabled": "false"},
 		map[string]string{"advanced": "setting"},
 		logger,
 	)
diff --git a/proxy/cache/redis.go b/proxy/cache/redis.go
index 4896a85d..a7da8035 100644
--- a/proxy/cache/redis.go
+++ b/proxy/cache/redis.go
@@ -139,8 +139,8 @@ func (c *RedisCache) GetCustomRulesHash(ctx context.Context, hashId string) (map
 	return cmd.Val(), nil
 }
 
-// GetProfileSettingsBatch fetches privacy, logs, DNSSEC, and advanced settings
-// for a profile in a single Redis pipeline round-trip (1 RTT instead of 4).
+// GetProfileSettingsBatch fetches privacy, logs, DNSSEC, rebinding protection, and
+// advanced settings for a profile in a single Redis pipeline round-trip.
 func (c *RedisCache) GetProfileSettingsBatch(ctx context.Context, profileId string) (*model.ProfileSettings, error) {
 	if profileId == "" {
 		return nil, fmt.Errorf("profile ID cannot be empty")
@@ -149,12 +149,14 @@ func (c *RedisCache) GetProfileSettingsBatch(ctx context.Context, profileId stri
 	privacyKey := "settings:" + profileId + ":privacy"
 	logsKey := "settings:" + profileId + ":logs"
 	dnssecKey := "settings:" + profileId + ":security:dnssec"
+	rebindingKey := "settings:" + profileId + ":security:rebinding_protection"
 	advancedKey := "settings:" + profileId + ":advanced"
 
 	pipe := c.client().Pipeline()
 	privacyCmd := pipe.HGetAll(ctx, privacyKey)
 	logsCmd := pipe.HGetAll(ctx, logsKey)
 	dnssecCmd := pipe.HGetAll(ctx, dnssecKey)
+	rebindingCmd := pipe.HGetAll(ctx, rebindingKey)
 	advancedCmd := pipe.HGetAll(ctx, advancedKey)
 
 	_, err := pipe.Exec(ctx)
@@ -166,7 +168,7 @@ func (c *RedisCache) GetProfileSettingsBatch(ctx context.Context, profileId stri
 		// failure (e.g. TCP reset, auth error) — return it so the caller can
 		// log the real cause instead of a misleading "profile not found".
 		if privacyCmd.Err() == err && logsCmd.Err() == err &&
-			dnssecCmd.Err() == err && advancedCmd.Err() == err {
+			dnssecCmd.Err() == err && rebindingCmd.Err() == err && advancedCmd.Err() == err {
 			return nil, fmt.Errorf("redis pipeline failed: %w", err)
 		}
 		// Otherwise it's a partial failure — handle per-command below.
@@ -205,6 +207,16 @@ func (c *RedisCache) GetProfileSettingsBatch(ctx context.Context, profileId stri
 		result.DNSSEC = dnssecCmd.Val()
 	}
 
+	// Rebinding protection (security). Missing hash = empty map = opt-in OFF.
+	switch {
+	case rebindingCmd.Err() != nil:
+		result.RebindingProtectionErr = rebindingCmd.Err()
+	case len(rebindingCmd.Val()) == 0:
+		result.RebindingProtectionErr = fmt.Errorf("No [security rebinding_protection] settings found for profile %s", profileId)
+	default:
+		result.RebindingProtection = rebindingCmd.Val()
+	}
+
 	// Advanced
 	switch {
 	case advancedCmd.Err() != nil:
diff --git a/proxy/config/config.go b/proxy/config/config.go
index 403dbeb8..99387632 100644
--- a/proxy/config/config.go
+++ b/proxy/config/config.go
@@ -30,10 +30,21 @@ type Config struct {
 	Log                 *LogConfig
 	RateLimit           *RateLimitConfig
 	Metrics             *MetricsConfig
+	Rebinding           *RebindingConfig
 	TrustedProxies      []string
 	ProfileIDMinLength  int
 }
 
+// RebindingConfig configures DNS rebinding protection (block answers where a public
+// name resolves to a private/loopback/link-local IP). The per-profile opt-in
+// toggle lives in Redis; this is the global operator config.
+type RebindingConfig struct {
+	Enabled       bool     // REBINDING_PROTECTION_ENABLED (master switch, default true)
+	BlockCGNAT    bool     // REBINDING_BLOCK_CGNAT - block 100.64.0.0/10 (default false, opt-in)
+	BlockNAT64    bool     // REBINDING_BLOCK_NAT64 - block 64:ff9b::/96 (default false, opt-in)
+	AllowSuffixes []string // REBINDING_ALLOW_SUFFIXES - CSV; names with these suffixes are never blocked
+}
+
 // DNSCacheConfig configures the vendor (AdGuard) DNS response cache.
 type DNSCacheConfig struct {
 	Enabled    bool   // DNS_CACHE_ENABLED (default false)
@@ -147,6 +158,31 @@ func getEnvBool(env string) bool {
 	return v == "true" || v == "1"
 }
 
+// getEnvBoolDefault returns the environment variable as a bool, falling back to
+// def when the variable is unset or empty (unlike getEnvBool, which defaults false).
+func getEnvBoolDefault(env string, def bool) bool {
+	v := strings.ToLower(strings.TrimSpace(os.Getenv(env)))
+	if v == "" {
+		return def
+	}
+	return v == "true" || v == "1"
+}
+
+// loadRebindingConfig reads DNS rebinding protection settings from environment
+// variables. The master switch defaults ON; CGNAT/NAT64 blocking are opt-in.
+func loadRebindingConfig() *RebindingConfig {
+	cfg := &RebindingConfig{
+		Enabled:       getEnvBoolDefault("REBINDING_PROTECTION_ENABLED", true),
+		BlockCGNAT:    getEnvBool("REBINDING_BLOCK_CGNAT"),
+		BlockNAT64:    getEnvBool("REBINDING_BLOCK_NAT64"),
+		AllowSuffixes: parseCSV(os.Getenv("REBINDING_ALLOW_SUFFIXES")),
+	}
+	if len(cfg.AllowSuffixes) == 0 {
+		cfg.AllowSuffixes = []string{".local", ".lan", ".home.arpa", ".internal"}
+	}
+	return cfg
+}
+
 // GetEnvInt returns the integer value of an environment variable
 func GetEnvInt(env string) (int, error) {
 	var envValInt int
@@ -301,6 +337,7 @@ func New() (*Config, error) {
 	}
 
 	dnsCacheCfg := loadDNSCacheConfig()
+	rebindingCfg := loadRebindingConfig()
 	// Profile settings in-memory cache TTL (default 30s, "0" disables expiration)
 	profileSettingsCacheTTL := 30 * time.Second
 	if v := os.Getenv("PROFILE_SETTINGS_CACHE_TTL"); v != "" {
@@ -349,6 +386,7 @@ func New() (*Config, error) {
 			GeoIPASNDBPath:     geoIPASNDBPath,
 		},
 		DNSCache:           dnsCacheCfg,
+		Rebinding:          rebindingCfg,
 		TrustedProxies:     trustedProxies,
 		ProfileIDMinLength: profileIdMinLen,
 		Cache: &cache.Config{
diff --git a/proxy/filter/aggregate.go b/proxy/filter/aggregate.go
index 13096a26..d52a31d1 100644
--- a/proxy/filter/aggregate.go
+++ b/proxy/filter/aggregate.go
@@ -10,6 +10,7 @@ const (
 	TierDefaultRule = 0
 	TierBlocklists  = 100
 	TierServices    = 100
+	TierRebinding   = 150
 	TierCustomRules = 200
 )
 
diff --git a/proxy/filter/cross_phase_aggregation_test.go b/proxy/filter/cross_phase_aggregation_test.go
index c9a51501..e86b6d62 100644
--- a/proxy/filter/cross_phase_aggregation_test.go
+++ b/proxy/filter/cross_phase_aggregation_test.go
@@ -355,7 +355,7 @@ func TestIPFilter_CrossPhaseAggregation(t *testing.T) {
 					Return(rule, nil).Maybe()
 			}
 
-			ipFilter := NewIPFilter(&proxy.Proxy{}, mockCache, tt.catalog, tt.asnLookup)
+			ipFilter := NewIPFilter(&proxy.Proxy{}, mockCache, tt.catalog, tt.asnLookup, nil)
 
 			reqCtx := newTestReqCtx(t, profileID)
 			// Pre-populate with domain-phase results to simulate the real pipeline.
@@ -389,6 +389,54 @@ func TestIPFilter_CrossPhaseAggregation(t *testing.T) {
 	}
 }
 
+// TestIPFilter_RebindingCrossPhase verifies that a custom Allow (T200) overrides a
+// rebinding block (T150) through unified aggregation, and that rebinding alone blocks
+// a private-IP answer when no Allow is present (table #R12).
+func TestIPFilter_RebindingCrossPhase(t *testing.T) {
+	const profileID = "rebinding-cross-phase"
+
+	tests := []struct {
+		name          string
+		tableRef      string
+		domainResults []model.StageResult
+		wantStatus    model.Status
+	}{
+		{
+			name:          "#R12 — Rebinding Block alone → Blocked (private IP, opt-in on)",
+			tableRef:      "R12",
+			domainResults: nil,
+			wantStatus:    model.StatusBlocked,
+		},
+		{
+			name:          "#R12 — Domain CR Allow (T200) + Rebinding Block (T150) → Processed (allow wins)",
+			tableRef:      "R12",
+			domainResults: []model.StageResult{domainAllowResult()},
+			wantStatus:    model.StatusProcessed,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			mockCache := new(mocks.Cache)
+			mockCache.On("GetProfileServicesBlocked", mock.Anything, profileID).
+				Return([]string{}, nil).Maybe()
+			mockCache.On("GetCustomRulesHashes", mock.Anything, profileID).
+				Return([]string{}, nil).Maybe()
+
+			ipFilter := NewIPFilter(&proxy.Proxy{}, mockCache, nil, nil, defaultRebindingConfig())
+
+			reqCtx := newTestReqCtx(t, profileID)
+			reqCtx.RebindingProtectionSettings = map[string]string{"enabled": "true"}
+			reqCtx.PartialFilteringResults = append(reqCtx.PartialFilteringResults, tt.domainResults...)
+
+			err := ipFilter.Execute(reqCtx, dnsCtxWithAAnswer(t, "192.168.1.1"))
+			assert.NoError(t, err)
+			assert.Equal(t, tt.wantStatus, reqCtx.FilterResult.Status,
+				"table %s: expected status %s", tt.tableRef, tt.wantStatus)
+		})
+	}
+}
+
 // TestIPFilter_NilResponse_PreservesDomainBlock verifies that when dctx.Res is
 // nil (domain blocked, no upstream resolution), IPFilter.Execute preserves the
 // domain block through unified aggregation. The server-level postResolve guard
@@ -434,7 +482,7 @@ func TestIPFilter_NilResponse_PreservesDomainBlock(t *testing.T) {
 			mockCache.On("GetCustomRulesHashes", mock.Anything, profileID).
 				Return([]string{}, nil).Maybe()
 
-			ipFilter := NewIPFilter(&proxy.Proxy{}, mockCache, nil, nil)
+			ipFilter := NewIPFilter(&proxy.Proxy{}, mockCache, nil, nil, nil)
 
 			reqCtx := newTestReqCtx(t, profileID)
 			reqCtx.PartialFilteringResults = append(
@@ -546,7 +594,7 @@ func TestIPFilter_NilResponse_IPAllowInert(t *testing.T) {
 					Return(rule, nil).Maybe()
 			}
 
-			ipFilter := NewIPFilter(&proxy.Proxy{}, mockCache, tt.catalog, tt.asnLookup)
+			ipFilter := NewIPFilter(&proxy.Proxy{}, mockCache, tt.catalog, tt.asnLookup, nil)
 
 			reqCtx := newTestReqCtx(t, profileID)
 			reqCtx.PartialFilteringResults = append(
@@ -596,6 +644,7 @@ func TestIPFilter_CrossPhaseAggregation_PartialResultsGrow(t *testing.T) {
 		&proxy.Proxy{}, mockCache,
 		staticCatalog{cat: googleCatalogWithASN(asn)},
 		staticASNLookup{asn: asn},
+		nil,
 	)
 
 	reqCtx := newTestReqCtx(t, profileID)
@@ -606,8 +655,8 @@ func TestIPFilter_CrossPhaseAggregation_PartialResultsGrow(t *testing.T) {
 	err := ipFilter.Execute(reqCtx, dnsCtx)
 	assert.NoError(t, err)
 
-	// Domain (1) + services (1) + custom rules (1) = 3 partial results.
-	assert.Equal(t, 3, len(reqCtx.PartialFilteringResults),
+	// Domain (1) + services (1) + rebinding (1) + custom rules (1) = 4 partial results.
+	assert.Equal(t, 4, len(reqCtx.PartialFilteringResults),
 		"PartialFilteringResults should contain domain + all IP-phase results")
 
 	// Final decision based on unified aggregation: domain Allow (T200) wins
@@ -674,7 +723,7 @@ func TestIPFilter_DnsCtxWithAddr(t *testing.T) {
 			"action": ACTION_BLOCK, "value": answerIP, "syntax": "ip4_addr",
 		}, nil)
 
-	ipFilter := NewIPFilter(&proxy.Proxy{}, mockCache, nil, nil)
+	ipFilter := NewIPFilter(&proxy.Proxy{}, mockCache, nil, nil, nil)
 
 	reqCtx := newTestReqCtx(t, profileID)
 	reqCtx.PartialFilteringResults = []model.StageResult{domainAllowResult()}
diff --git a/proxy/filter/ip.go b/proxy/filter/ip.go
index e0b07cbe..76aec908 100644
--- a/proxy/filter/ip.go
+++ b/proxy/filter/ip.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/AdguardTeam/dnsproxy/proxy"
 	"github.com/ivpn/dns/proxy/cache"
+	"github.com/ivpn/dns/proxy/config"
 	"github.com/ivpn/dns/proxy/model"
 	"github.com/ivpn/dns/proxy/requestcontext"
 	"github.com/miekg/dns"
@@ -16,20 +17,23 @@ type IPFilter struct {
 	Proxy           *proxy.Proxy
 	ServicesCatalog ServicesCatalogGetter
 	ASNLookup       ASNLookup
+	RebindingConfig *config.RebindingConfig
 	// patternCache   sync.Map
 	FilteringFuncs []func(reqCtx *requestcontext.RequestContext, dctx *proxy.DNSContext) (*model.StageResult, error)
 }
 
 // NewIPFilter creates a new IPFilter instance
-func NewIPFilter(dnsProxy *proxy.Proxy, cache cache.Cache, servicesCatalog ServicesCatalogGetter, asnLookup ASNLookup) *IPFilter {
+func NewIPFilter(dnsProxy *proxy.Proxy, cache cache.Cache, servicesCatalog ServicesCatalogGetter, asnLookup ASNLookup, rebindingConfig *config.RebindingConfig) *IPFilter {
 	fltrManager := &IPFilter{
 		Cache:           cache,
 		Proxy:           dnsProxy,
 		ServicesCatalog: servicesCatalog,
 		ASNLookup:       asnLookup,
+		RebindingConfig: rebindingConfig,
 	}
 	fltrManager.FilteringFuncs = []func(reqCtx *requestcontext.RequestContext, dctx *proxy.DNSContext) (*model.StageResult, error){
 		fltrManager.filterServices,
+		fltrManager.filterRebinding,
 		fltrManager.filterCustomRules,
 	}
 	return fltrManager
diff --git a/proxy/filter/ip_custom_rules_asn_test.go b/proxy/filter/ip_custom_rules_asn_test.go
index 826d4488..4d323b96 100644
--- a/proxy/filter/ip_custom_rules_asn_test.go
+++ b/proxy/filter/ip_custom_rules_asn_test.go
@@ -41,7 +41,7 @@ func TestIPFilter_BlockWinsOnConflict_CustomRules_ASN(t *testing.T) {
 	mockASN.On("ASN", net.ParseIP(blockIP)).Return(allowASN, nil)
 
 	dnsProxy := &proxy.Proxy{}
-	ipFilter := NewIPFilter(dnsProxy, mockCache, nil, mockASN)
+	ipFilter := NewIPFilter(dnsProxy, mockCache, nil, mockASN, nil)
 
 	req := new(dns.Msg)
 	req.SetQuestion("example.com.", dns.TypeA)
@@ -83,7 +83,7 @@ func TestIPFilter_BlockByASN_CustomRules(t *testing.T) {
 	mockASN.On("ASN", net.ParseIP(ipStr)).Return(asn, nil)
 
 	dnsProxy := &proxy.Proxy{}
-	ipFilter := NewIPFilter(dnsProxy, mockCache, nil, mockASN)
+	ipFilter := NewIPFilter(dnsProxy, mockCache, nil, mockASN, nil)
 
 	req := new(dns.Msg)
 	req.SetQuestion("example.com.", dns.TypeA)
diff --git a/proxy/filter/ip_custom_rules_precedence_test.go b/proxy/filter/ip_custom_rules_precedence_test.go
index 84c4f865..c1687c5f 100644
--- a/proxy/filter/ip_custom_rules_precedence_test.go
+++ b/proxy/filter/ip_custom_rules_precedence_test.go
@@ -44,7 +44,7 @@ func TestIPFilter_BlockWinsOnConflict_CustomRules_IP(t *testing.T) {
 
 	// Create filter manager with mock cache
 	dnsProxy := &proxy.Proxy{}
-	ipFilter := NewIPFilter(dnsProxy, mockCache, nil, nil)
+	ipFilter := NewIPFilter(dnsProxy, mockCache, nil, nil, nil)
 
 	// Create DNS request/response with two A answers.
 	req := new(dns.Msg)
diff --git a/proxy/filter/ip_custom_rules_test.go b/proxy/filter/ip_custom_rules_test.go
index fa9b66c5..b1a893b4 100644
--- a/proxy/filter/ip_custom_rules_test.go
+++ b/proxy/filter/ip_custom_rules_test.go
@@ -252,7 +252,7 @@ func TestIPFilterCustomRules(t *testing.T) {
 					Return(rule, nil).Maybe()
 			}
 
-			fm := NewIPFilter(&proxy.Proxy{}, mockCache, nil, nil)
+			fm := NewIPFilter(&proxy.Proxy{}, mockCache, nil, nil, nil)
 
 			reqCtx := &requestcontext.RequestContext{
 				ProfileId: tt.profileID,
@@ -311,7 +311,7 @@ func TestIPFilterCustomRules_CacheErrors(t *testing.T) {
 			mockCache := new(mocks.Cache)
 			tt.setupMock(mockCache)
 
-			fm := NewIPFilter(&proxy.Proxy{}, mockCache, nil, nil)
+			fm := NewIPFilter(&proxy.Proxy{}, mockCache, nil, nil, nil)
 
 			reqCtx := &requestcontext.RequestContext{
 				ProfileId: "test-profile",
diff --git a/proxy/filter/rebinding.go b/proxy/filter/rebinding.go
new file mode 100644
index 00000000..e06f7064
--- /dev/null
+++ b/proxy/filter/rebinding.go
@@ -0,0 +1,92 @@
+package filter
+
+import (
+	"strings"
+
+	"github.com/AdguardTeam/dnsproxy/proxy"
+	"github.com/getsentry/sentry-go"
+	"github.com/ivpn/dns/proxy/model"
+	"github.com/ivpn/dns/proxy/requestcontext"
+)
+
+const (
+	REASON_REBINDING = "rebinding_protection"
+
+	// rebindingEnabledKey is the field read from the per-profile
+	// settings:<id>:security:rebinding_protection Redis hash.
+	rebindingEnabledKey = "enabled"
+)
+
+// filterRebinding blocks DNS answers where a public name resolves to a
+// private/loopback/link-local IP (a DNS rebinding attempt). It runs in the IP
+// phase at TierRebinding (150): below custom rules (T200), so a user custom Allow
+// always overrides it via the Allow-wins aggregation.
+//
+// It is per-profile opt-in: the profile must have rebinding_protection enabled, and
+// the global master switch must be on. Names matching an operator allow-suffix
+// (e.g. .local) are never blocked.
+func (f *IPFilter) filterRebinding(reqCtx *requestcontext.RequestContext, dctx *proxy.DNSContext) (*model.StageResult, error) {
+	defer sentry.Recover()
+
+	result := &model.StageResult{Decision: model.DecisionNone, Tier: TierRebinding}
+
+	if dctx == nil || dctx.Res == nil {
+		return result, nil
+	}
+
+	// Global master switch.
+	if f.RebindingConfig == nil || !f.RebindingConfig.Enabled {
+		return result, nil
+	}
+
+	// Per-profile opt-in (default OFF). Absent/empty hash → not enabled.
+	if reqCtx.RebindingProtectionSettings[rebindingEnabledKey] != "true" {
+		return result, nil
+	}
+
+	// Operator allow-suffix list (split-horizon names like .local, .lan).
+	if len(dctx.Req.Question) > 0 && isRebindingAllowedSuffix(dctx.Req.Question[0].Name, f.RebindingConfig.AllowSuffixes) {
+		return result, nil
+	}
+
+	ips := extractIPsFromAnswer(dctx.Res.Answer)
+	for _, ip := range ips {
+		if isPrivateRebindingIP(ip, f.RebindingConfig) {
+			result.Decision = model.DecisionBlock
+			result.Reasons = append(result.Reasons, REASON_REBINDING)
+			reqCtx.AddDomain(
+				reqCtx.Logger.Debug().Str("reason", REASON_REBINDING).Str("private_ip", ip.String()),
+				dctx.Req.Question[0].Name,
+			).Msg("Blocked DNS rebinding (public name → private IP)")
+			return result, nil
+		}
+	}
+
+	return result, nil
+}
+
+// isRebindingAllowedSuffix reports whether name matches any operator allow-suffix.
+// name is the DNS question name (lowercased and trailing dot trimmed before
+// comparison). A suffix like ".local" matches "foo.local"; a bare "local" name
+// also matches the ".local" suffix.
+func isRebindingAllowedSuffix(name string, suffixes []string) bool {
+	name = strings.ToLower(strings.TrimSuffix(name, "."))
+	if name == "" {
+		return false
+	}
+	for _, suffix := range suffixes {
+		suffix = strings.ToLower(strings.TrimSpace(suffix))
+		if suffix == "" {
+			continue
+		}
+		if strings.HasSuffix(name, suffix) {
+			return true
+		}
+		// Allow a bare label equal to the suffix without its leading dot
+		// (e.g. name "local" with suffix ".local").
+		if name == strings.TrimPrefix(suffix, ".") {
+			return true
+		}
+	}
+	return false
+}
diff --git a/proxy/filter/rebinding_benchmark_test.go b/proxy/filter/rebinding_benchmark_test.go
new file mode 100644
index 00000000..53b9756e
--- /dev/null
+++ b/proxy/filter/rebinding_benchmark_test.go
@@ -0,0 +1,69 @@
+package filter
+
+import (
+	"net"
+	"testing"
+
+	"github.com/AdguardTeam/dnsproxy/proxy"
+	"github.com/miekg/dns"
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ivpn/dns/libs/logging"
+	"github.com/ivpn/dns/proxy/requestcontext"
+)
+
+// benchRebindingCtx builds a DNS context with `count` A answers, the last of which
+// is private when `private` is true (worst case: must scan the whole answer set).
+func benchRebindingCtx(count int, private bool) *proxy.DNSContext {
+	req := new(dns.Msg)
+	req.SetQuestion("example.com.", dns.TypeA)
+	res := new(dns.Msg)
+	res.SetReply(req)
+	answers := make([]dns.RR, 0, count)
+	for i := 0; i < count; i++ {
+		ip := net.IPv4(1, 1, 1, byte(i%256))
+		if private && i == count-1 {
+			ip = net.ParseIP("192.168.1.1")
+		}
+		answers = append(answers, &dns.A{
+			Hdr: dns.RR_Header{Name: "example.com.", Rrtype: dns.TypeA, Class: dns.ClassINET, Ttl: 60},
+			A:   ip,
+		})
+	}
+	res.Answer = answers
+	return &proxy.DNSContext{Req: req, Res: res}
+}
+
+func BenchmarkFilterRebinding(b *testing.B) {
+	cases := []struct {
+		name    string
+		answers int
+		private bool
+	}{
+		{"NoMatch_1", 1, false},
+		{"NoMatch_10", 10, false},
+		{"Match_1", 1, true},
+		{"Match_10", 10, true},
+	}
+
+	loggerFactory := logging.NewFactory(zerolog.Disabled)
+	for _, tc := range cases {
+		b.Run(tc.name, func(b *testing.B) {
+			f := &IPFilter{RebindingConfig: defaultRebindingConfig()}
+			reqCtx := &requestcontext.RequestContext{
+				ProfileId:                   "bench",
+				Logger:                      loggerFactory.ForProfile("bench", false),
+				RebindingProtectionSettings: map[string]string{"enabled": "true"},
+			}
+			dctx := benchRebindingCtx(tc.answers, tc.private)
+
+			b.ResetTimer()
+			for i := 0; i < b.N; i++ {
+				res, err := f.filterRebinding(reqCtx, dctx)
+				require.NoError(b, err)
+				require.NotNil(b, res)
+			}
+		})
+	}
+}
diff --git a/proxy/filter/rebinding_ranges.go b/proxy/filter/rebinding_ranges.go
new file mode 100644
index 00000000..4e5647e7
--- /dev/null
+++ b/proxy/filter/rebinding_ranges.go
@@ -0,0 +1,73 @@
+package filter
+
+import (
+	"net"
+
+	"github.com/ivpn/dns/proxy/config"
+)
+
+// mustCIDR parses a CIDR at init time; it panics on a malformed literal, which
+// can only happen if a constant below is edited incorrectly.
+func mustCIDR(s string) *net.IPNet {
+	_, n, err := net.ParseCIDR(s)
+	if err != nil {
+		panic("filter: invalid rebinding CIDR " + s + ": " + err.Error())
+	}
+	return n
+}
+
+// alwaysPrivateRanges are the IP ranges always treated as private/local for DNS
+// rebinding protection. A public name resolving into any of these is a rebinding
+// attempt. Mirrors unbound's private-address defaults plus loopback/link-local.
+// Go's net.IP.IsPrivate() alone is insufficient (it misses 127/8, link-local,
+// unspecified, IPv4-mapped IPv6), so the set is explicit.
+var alwaysPrivateRanges = []*net.IPNet{
+	// IPv4
+	mustCIDR("0.0.0.0/8"),      // "this" network / unspecified
+	mustCIDR("10.0.0.0/8"),     // RFC1918 private
+	mustCIDR("127.0.0.0/8"),    // loopback
+	mustCIDR("169.254.0.0/16"), // link-local
+	mustCIDR("172.16.0.0/12"),  // RFC1918 private
+	mustCIDR("192.168.0.0/16"), // RFC1918 private
+	// IPv6
+	mustCIDR("::/128"),    // unspecified
+	mustCIDR("::1/128"),   // loopback
+	mustCIDR("fc00::/7"),  // unique local addresses
+	mustCIDR("fe80::/10"), // link-local
+}
+
+// cgnatRange is RFC6598 carrier-grade NAT space. Opt-in (default off) because
+// many ISPs legitimately return CGNAT addresses to carrier-NAT'd users — this
+// matches Hagezi, dnsmasq --stop-dns-rebinding, and unbound private-address defaults.
+var cgnatRange = mustCIDR("100.64.0.0/10")
+
+// nat64Range is the well-known NAT64 prefix (RFC6052). Opt-in (default off) to
+// avoid breaking legitimate NAT64 networks.
+var nat64Range = mustCIDR("64:ff9b::/96")
+
+// isPrivateRebindingIP reports whether ip falls into a range that, when returned for
+// a public name, indicates a DNS rebinding attempt. IPv4-mapped IPv6 addresses
+// (::ffff:a.b.c.d) are unwrapped to their IPv4 form before checking — otherwise
+// a mapped private address would bypass the IPv4 ranges (a gap the Hagezi list has).
+func isPrivateRebindingIP(ip net.IP, cfg *config.RebindingConfig) bool {
+	if ip == nil {
+		return false
+	}
+	// Unwrap IPv4-mapped IPv6 so ::ffff:192.168.1.1 is checked as 192.168.1.1.
+	if v4 := ip.To4(); v4 != nil {
+		ip = v4
+	}
+
+	for _, n := range alwaysPrivateRanges {
+		if n.Contains(ip) {
+			return true
+		}
+	}
+	if cfg != nil && cfg.BlockCGNAT && cgnatRange.Contains(ip) {
+		return true
+	}
+	if cfg != nil && cfg.BlockNAT64 && nat64Range.Contains(ip) {
+		return true
+	}
+	return false
+}
diff --git a/proxy/filter/rebinding_test.go b/proxy/filter/rebinding_test.go
new file mode 100644
index 00000000..d62fb9c5
--- /dev/null
+++ b/proxy/filter/rebinding_test.go
@@ -0,0 +1,161 @@
+package filter
+
+import (
+	"net"
+	"testing"
+
+	"github.com/AdguardTeam/dnsproxy/proxy"
+	"github.com/ivpn/dns/proxy/config"
+	"github.com/ivpn/dns/proxy/model"
+	"github.com/miekg/dns"
+	"github.com/stretchr/testify/assert"
+)
+
+// dnsCtxNameA builds an A-record DNS context for an arbitrary question name.
+func dnsCtxNameA(t *testing.T, name, ipStr string) *proxy.DNSContext {
+	t.Helper()
+	req := new(dns.Msg)
+	req.SetQuestion(name, dns.TypeA)
+	res := new(dns.Msg)
+	res.SetReply(req)
+	res.Answer = []dns.RR{
+		&dns.A{Hdr: dns.RR_Header{Name: name, Rrtype: dns.TypeA, Class: dns.ClassINET, Ttl: 60}, A: net.ParseIP(ipStr)},
+	}
+	return &proxy.DNSContext{Req: req, Res: res}
+}
+
+// dnsCtxPTR builds a PTR query/response (no A/AAAA records to inspect).
+func dnsCtxPTR(t *testing.T) *proxy.DNSContext {
+	t.Helper()
+	req := new(dns.Msg)
+	req.SetQuestion("1.0.168.192.in-addr.arpa.", dns.TypePTR)
+	res := new(dns.Msg)
+	res.SetReply(req)
+	res.Answer = []dns.RR{
+		&dns.PTR{Hdr: dns.RR_Header{Name: "1.0.168.192.in-addr.arpa.", Rrtype: dns.TypePTR, Class: dns.ClassINET, Ttl: 60}, Ptr: "router.lan."},
+	}
+	return &proxy.DNSContext{Req: req, Res: res}
+}
+
+func defaultRebindingConfig() *config.RebindingConfig {
+	return &config.RebindingConfig{
+		Enabled:       true,
+		BlockCGNAT:    false,
+		BlockNAT64:    false,
+		AllowSuffixes: []string{".local", ".lan", ".home.arpa", ".internal"},
+	}
+}
+
+// TestFilterRebinding covers the DNS rebinding protection IP sub-filter (TierRebinding,
+// T150). Rows trace to docs/specs/proxy-filtering-behaviour.md "DNS rebinding
+// protection" decision table.
+func TestFilterRebinding(t *testing.T) {
+	enabled := map[string]string{"enabled": "true"}
+
+	tests := []struct {
+		name     string
+		tableRef string
+		cfg      *config.RebindingConfig
+		settings map[string]string
+		dctx     *proxy.DNSContext
+		want     model.Decision
+	}{
+		// Always-private IPv4 ranges → block when opt-in on.
+		{"R1 private 10/8 blocked", "R1", defaultRebindingConfig(), enabled, dnsCtxWithAAnswer(t, "10.0.0.5"), model.DecisionBlock},
+		{"R1 private 192.168/16 blocked", "R1", defaultRebindingConfig(), enabled, dnsCtxWithAAnswer(t, "192.168.1.1"), model.DecisionBlock},
+		{"R1 private 172.16/12 blocked", "R1", defaultRebindingConfig(), enabled, dnsCtxWithAAnswer(t, "172.16.5.5"), model.DecisionBlock},
+		{"R1 loopback 127/8 blocked", "R1", defaultRebindingConfig(), enabled, dnsCtxWithAAnswer(t, "127.0.0.1"), model.DecisionBlock},
+		{"R1 link-local 169.254/16 blocked", "R1", defaultRebindingConfig(), enabled, dnsCtxWithAAnswer(t, "169.254.1.1"), model.DecisionBlock},
+		{"R1 unspecified 0/8 blocked", "R1", defaultRebindingConfig(), enabled, dnsCtxWithAAnswer(t, "0.0.0.0"), model.DecisionBlock},
+
+		// Always-private IPv6 ranges.
+		{"R2 IPv6 loopback ::1 blocked", "R2", defaultRebindingConfig(), enabled, dnsCtxWithAAnswer(t, "::1"), model.DecisionBlock},
+		{"R2 IPv6 ULA fc00::/7 blocked", "R2", defaultRebindingConfig(), enabled, dnsCtxWithAAnswer(t, "fd00::1"), model.DecisionBlock},
+		{"R2 IPv6 link-local fe80::/10 blocked", "R2", defaultRebindingConfig(), enabled, dnsCtxWithAAnswer(t, "fe80::1"), model.DecisionBlock},
+
+		// IPv4-mapped IPv6 must be unwrapped and blocked.
+		{"R3 IPv4-mapped private blocked", "R3", defaultRebindingConfig(), enabled, dnsCtxWithAAnswer(t, "::ffff:192.168.1.1"), model.DecisionBlock},
+
+		// Public IPs pass.
+		{"R4 public IPv4 passes", "R4", defaultRebindingConfig(), enabled, dnsCtxWithAAnswer(t, "1.1.1.1"), model.DecisionNone},
+		{"R4 public IPv6 passes", "R4", defaultRebindingConfig(), enabled, dnsCtxWithAAnswer(t, "2606:4700:4700::1111"), model.DecisionNone},
+
+		// Per-profile opt-in OFF (default) → never blocks even for private IP.
+		{"R5 opt-in off (empty) passes", "R5", defaultRebindingConfig(), map[string]string{}, dnsCtxWithAAnswer(t, "192.168.1.1"), model.DecisionNone},
+		{"R5 opt-in off (false) passes", "R5", defaultRebindingConfig(), map[string]string{"enabled": "false"}, dnsCtxWithAAnswer(t, "192.168.1.1"), model.DecisionNone},
+
+		// Global master switch OFF → never blocks.
+		{"R6 master switch off passes", "R6", &config.RebindingConfig{Enabled: false}, enabled, dnsCtxWithAAnswer(t, "192.168.1.1"), model.DecisionNone},
+		{"R6 nil config passes", "R6", nil, enabled, dnsCtxWithAAnswer(t, "192.168.1.1"), model.DecisionNone},
+
+		// CGNAT 100.64/10 — opt-in.
+		{"R7 CGNAT off (default) passes", "R7", defaultRebindingConfig(), enabled, dnsCtxWithAAnswer(t, "100.64.0.1"), model.DecisionNone},
+		{"R7 CGNAT on blocks", "R7", &config.RebindingConfig{Enabled: true, BlockCGNAT: true}, enabled, dnsCtxWithAAnswer(t, "100.64.0.1"), model.DecisionBlock},
+
+		// NAT64 64:ff9b::/96 — opt-in.
+		{"R8 NAT64 off (default) passes", "R8", defaultRebindingConfig(), enabled, dnsCtxWithAAnswer(t, "64:ff9b::1.2.3.4"), model.DecisionNone},
+		{"R8 NAT64 on blocks", "R8", &config.RebindingConfig{Enabled: true, BlockNAT64: true}, enabled, dnsCtxWithAAnswer(t, "64:ff9b::1.2.3.4"), model.DecisionBlock},
+
+		// Operator allow-suffix → private IP allowed for split-horizon names.
+		{"R9 .local suffix passes", "R9", defaultRebindingConfig(), enabled, dnsCtxNameA(t, "router.local.", "192.168.1.1"), model.DecisionNone},
+		{"R9 .lan suffix passes", "R9", defaultRebindingConfig(), enabled, dnsCtxNameA(t, "nas.lan.", "10.0.0.2"), model.DecisionNone},
+		{"R9 non-allowed suffix blocked", "R9", defaultRebindingConfig(), enabled, dnsCtxNameA(t, "evil.com.", "192.168.1.1"), model.DecisionBlock},
+
+		// PTR query — no A/AAAA records → none.
+		{"R10 PTR query passes", "R10", defaultRebindingConfig(), enabled, dnsCtxPTR(t), model.DecisionNone},
+
+		// Nil guards.
+		{"R11 nil dctx passes", "R11", defaultRebindingConfig(), enabled, nil, model.DecisionNone},
+		{"R11 nil Res passes", "R11", defaultRebindingConfig(), enabled, &proxy.DNSContext{Req: new(dns.Msg)}, model.DecisionNone},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reqCtx := newTestReqCtx(t, "rebinding-test")
+			reqCtx.RebindingProtectionSettings = tt.settings
+			f := &IPFilter{RebindingConfig: tt.cfg}
+
+			res, err := f.filterRebinding(reqCtx, tt.dctx)
+			assert.NoError(t, err, "row %s", tt.tableRef)
+			assert.NotNil(t, res, "row %s", tt.tableRef)
+			assert.Equal(t, tt.want, res.Decision, "row %s: %s", tt.tableRef, tt.name)
+			assert.Equal(t, TierRebinding, res.Tier, "row %s: tier", tt.tableRef)
+			if tt.want == model.DecisionBlock {
+				assert.Contains(t, res.Reasons, REASON_REBINDING, "row %s: reason", tt.tableRef)
+			}
+		})
+	}
+}
+
+// TestFilterRebinding_HTTPSHint verifies private IPs in HTTPS/SVCB ipv4hint are caught.
+func TestFilterRebinding_HTTPSHint(t *testing.T) {
+	reqCtx := newTestReqCtx(t, "rebinding-https")
+	reqCtx.RebindingProtectionSettings = map[string]string{"enabled": "true"}
+	f := &IPFilter{RebindingConfig: defaultRebindingConfig()}
+
+	dctx := dnsCtxWithHTTPSAnswer(t, "evil.com.", []net.IP{net.ParseIP("192.168.1.1")}, nil)
+	res, err := f.filterRebinding(reqCtx, dctx)
+	assert.NoError(t, err)
+	assert.Equal(t, model.DecisionBlock, res.Decision)
+	assert.Contains(t, res.Reasons, REASON_REBINDING)
+}
+
+func TestIsRebindingAllowedSuffix(t *testing.T) {
+	suffixes := []string{".local", ".lan", ".home.arpa", ".internal"}
+	cases := []struct {
+		name string
+		want bool
+	}{
+		{"router.local.", true},
+		{"a.b.home.arpa.", true},
+		{"local.", true},      // bare label equal to suffix
+		{"localhost.", false}, // not a .local suffix
+		{"example.com.", false},
+		{"notlocal.", false},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			assert.Equal(t, c.want, isRebindingAllowedSuffix(c.name, suffixes))
+		})
+	}
+}
diff --git a/proxy/filter/services_test.go b/proxy/filter/services_test.go
index 11a50b90..9f50ac4e 100644
--- a/proxy/filter/services_test.go
+++ b/proxy/filter/services_test.go
@@ -241,8 +241,8 @@ func TestIPFilter_filterServices_Table(t *testing.T) {
 			asnLookup: mapASNLookup{asnByIP: map[string]uint{
 				"142.250.74.46": asn,
 			}},
-			blockedIDs: []string{"google"},
-			dnsCtx:     dnsCtxWithHTTPSAnswer(t, "example.com.", []net.IP{net.ParseIP("142.250.74.46").To4()}, nil),
+			blockedIDs:   []string{"google"},
+			dnsCtx:       dnsCtxWithHTTPSAnswer(t, "example.com.", []net.IP{net.ParseIP("142.250.74.46").To4()}, nil),
 			wantDecision: model.DecisionBlock,
 			wantReasons:  []string{REASON_SERVICES, "service: google"},
 		},
@@ -252,8 +252,8 @@ func TestIPFilter_filterServices_Table(t *testing.T) {
 			asnLookup: mapASNLookup{asnByIP: map[string]uint{
 				"2a00:1450:4010:c0a::5e": asn,
 			}},
-			blockedIDs: []string{"google"},
-			dnsCtx:     dnsCtxWithHTTPSAnswer(t, "example.com.", nil, []net.IP{net.ParseIP("2a00:1450:4010:c0a::5e")}),
+			blockedIDs:   []string{"google"},
+			dnsCtx:       dnsCtxWithHTTPSAnswer(t, "example.com.", nil, []net.IP{net.ParseIP("2a00:1450:4010:c0a::5e")}),
 			wantDecision: model.DecisionBlock,
 			wantReasons:  []string{REASON_SERVICES, "service: google"},
 		},
@@ -387,7 +387,7 @@ func TestIPFilter_ServicesBlocking_Integration_Table(t *testing.T) {
 			}
 
 			dnsProxy := &proxy.Proxy{}
-			ipFilter := NewIPFilter(dnsProxy, mockCache, staticCatalog{cat: tt.catalog}, tt.asnLookup)
+			ipFilter := NewIPFilter(dnsProxy, mockCache, staticCatalog{cat: tt.catalog}, tt.asnLookup, nil)
 			reqCtx := newTestReqCtx(t, tt.profileID)
 
 			err := ipFilter.Execute(reqCtx, tt.dnsCtx)
diff --git a/proxy/model/profile_settings.go b/proxy/model/profile_settings.go
index 114250c3..06bc84b4 100644
--- a/proxy/model/profile_settings.go
+++ b/proxy/model/profile_settings.go
@@ -2,15 +2,17 @@ package model
 
 // ProfileSettings holds all profile settings fetched in a single batch.
 type ProfileSettings struct {
-	Privacy  map[string]string
-	Logs     map[string]string
-	DNSSEC   map[string]string
-	Advanced map[string]string
+	Privacy             map[string]string
+	Logs                map[string]string
+	DNSSEC              map[string]string
+	RebindingProtection map[string]string
+	Advanced            map[string]string
 
 	// Per-key errors (nil means success). A missing key in Redis returns
 	// an empty map (not an error), so these only fire on real Redis failures.
-	PrivacyErr  error
-	LogsErr     error
-	DNSSECErr   error
-	AdvancedErr error
+	PrivacyErr             error
+	LogsErr                error
+	DNSSECErr              error
+	RebindingProtectionErr error
+	AdvancedErr            error
 }
diff --git a/proxy/requestcontext/logging_gating_test.go b/proxy/requestcontext/logging_gating_test.go
index 6e51d47f..a89e7c41 100644
--- a/proxy/requestcontext/logging_gating_test.go
+++ b/proxy/requestcontext/logging_gating_test.go
@@ -38,6 +38,7 @@ func TestAddDomain_DomainLoggingEnabled(t *testing.T) {
 		map[string]string{"log_domains": "true", "enabled": "true"},
 		map[string]string{},
 		map[string]string{},
+		map[string]string{},
 		logger,
 	)
 	ev := rc.Logger.Info()
@@ -83,6 +84,7 @@ func TestAddDomain_DomainLoggingDisabled(t *testing.T) {
 		map[string]string{"log_domains": "false", "enabled": "true"},
 		map[string]string{},
 		map[string]string{},
+		map[string]string{},
 		logger,
 	)
 	ev := rc.Logger.Info()
@@ -100,6 +102,7 @@ func TestMaybeDomain_DomainLoggingEnabled(t *testing.T) {
 		map[string]string{"log_domains": "true", "enabled": "true"},
 		map[string]string{},
 		map[string]string{},
+		map[string]string{},
 		logger,
 	)
 	ev := rc.Logger.Info()
diff --git a/proxy/requestcontext/request_context.go b/proxy/requestcontext/request_context.go
index 6ca34ca9..5ea814d1 100644
--- a/proxy/requestcontext/request_context.go
+++ b/proxy/requestcontext/request_context.go
@@ -12,31 +12,33 @@ import (
 
 type RequestContext struct {
 	// Ctx                     context.Context
-	ProfileId               string                  `json:"profile_id"`
-	DeviceId                string                  `json:"device_id"`
-	PrivacySettings         map[string]string       `json:"privacy_settings"`
-	LogsSettings            map[string]string       `json:"logs_settings"`
-	AdvancedSettings        map[string]string       `json:"advanced_settings"`
-	DNSSECSettings          map[string]string       `json:"dnssec_settings"`
-	PartialFilteringResults []model.StageResult     `json:"partial_filtering_results"`
-	FilterResult            model.FilterResult      `json:"filter_result"`
-	Logger                  logging.LoggerInterface `json:"-"`
-	LoggerConfig            logging.LoggingConfig   `json:"logger_config"`
-	StartTime               time.Time               `json:"-"`
-	UpstreamName            string                  `json:"-"`
+	ProfileId                   string                  `json:"profile_id"`
+	DeviceId                    string                  `json:"device_id"`
+	PrivacySettings             map[string]string       `json:"privacy_settings"`
+	LogsSettings                map[string]string       `json:"logs_settings"`
+	AdvancedSettings            map[string]string       `json:"advanced_settings"`
+	DNSSECSettings              map[string]string       `json:"dnssec_settings"`
+	RebindingProtectionSettings map[string]string       `json:"rebinding_protection_settings"`
+	PartialFilteringResults     []model.StageResult     `json:"partial_filtering_results"`
+	FilterResult                model.FilterResult      `json:"filter_result"`
+	Logger                      logging.LoggerInterface `json:"-"`
+	LoggerConfig                logging.LoggingConfig   `json:"logger_config"`
+	StartTime                   time.Time               `json:"-"`
+	UpstreamName                string                  `json:"-"`
 }
 
-func NewRequestContext(ctx context.Context, p *proxy.Proxy, profileId string, deviceId string, privacySettings, logsSettings, dnssecSettings, advancedSettings map[string]string, logger logging.LoggerInterface) *RequestContext {
+func NewRequestContext(ctx context.Context, p *proxy.Proxy, profileId string, deviceId string, privacySettings, logsSettings, dnssecSettings, rebindingProtectionSettings, advancedSettings map[string]string, logger logging.LoggerInterface) *RequestContext {
 	return &RequestContext{
 		// Ctx:              ctx,
-		ProfileId:        profileId,
-		DeviceId:         deviceId,
-		PrivacySettings:  privacySettings,
-		LogsSettings:     logsSettings,
-		DNSSECSettings:   dnssecSettings,
-		AdvancedSettings: advancedSettings,
-		Logger:           logger,
-		LoggerConfig:     logger.Config(),
+		ProfileId:                   profileId,
+		DeviceId:                    deviceId,
+		PrivacySettings:             privacySettings,
+		LogsSettings:                logsSettings,
+		DNSSECSettings:              dnssecSettings,
+		RebindingProtectionSettings: rebindingProtectionSettings,
+		AdvancedSettings:            advancedSettings,
+		Logger:                      logger,
+		LoggerConfig:                logger.Config(),
 	}
 }
 
diff --git a/proxy/server/server.go b/proxy/server/server.go
index 83166de8..899f4e79 100644
--- a/proxy/server/server.go
+++ b/proxy/server/server.go
@@ -122,7 +122,7 @@ func NewServer(serverConfig *config.Config, collectorChannels map[string]channel
 	log.Info().Str("catalog", serverConfig.Services.CatalogPath).Str("geodb", serverConfig.Services.GeoIPASNDBPath).Msg("Services blocking enabled")
 
 	server.DomainFilter = filter.NewDomainFilter(dnsProxy, cache, servicesCatalog)
-	server.IPFilter = filter.NewIPFilter(dnsProxy, cache, servicesCatalog, lookup)
+	server.IPFilter = filter.NewIPFilter(dnsProxy, cache, servicesCatalog, lookup, serverConfig.Rebinding)
 	server.Proxy = dnsProxy
 
 	profileIDMinLength = serverConfig.ProfileIDMinLength
@@ -270,6 +270,10 @@ func (s *Server) HandleBefore(p *proxy.Proxy, dctx *proxy.DNSContext) (err error
 			}
 		}
 
+		// Rebinding protection (security): missing hash = empty map = opt-in OFF.
+		// Raw map is threaded through; the IP-phase filter reads the "enabled" key.
+		rebindingProtectionSettings := settings.RebindingProtection
+
 		// Advanced settings: default upstream if unavailable.
 		advancedSettings := settings.Advanced
 		upstreamName := s.Config.Upstream.Default
@@ -285,7 +289,7 @@ func (s *Server) HandleBefore(p *proxy.Proxy, dctx *proxy.DNSContext) (err error
 
 		dctx.CustomUpstreamConfig = s.Upstreams[upstreamName]
 		reqLogger.Trace().Str("upstream", upstreamName).Msg("Upstream set")
-		reqCtx := requestcontext.NewRequestContext(context.Background(), p, profileId, deviceId, prvSettings, logsSettings, dnssecSettings, advancedSettings, reqLogger)
+		reqCtx := requestcontext.NewRequestContext(context.Background(), p, profileId, deviceId, prvSettings, logsSettings, dnssecSettings, rebindingProtectionSettings, advancedSettings, reqLogger)
 		reqCtx.StartTime = time.Now()
 		reqCtx.UpstreamName = upstreamName
 		// TODO: set TTL for this request context - it's unnecessary to keep it in cache for long time since it's read right away in RequestHandler
diff --git a/proxy/server/strict_no_logging_test.go b/proxy/server/strict_no_logging_test.go
index 65f24d4d..5c6aebd6 100644
--- a/proxy/server/strict_no_logging_test.go
+++ b/proxy/server/strict_no_logging_test.go
@@ -72,6 +72,7 @@ func TestStrictNoLogging_RequestContext_LoggerIntegration(t *testing.T) {
 		map[string]string{"enabled": "false"},
 		map[string]string{},
 		map[string]string{},
+		map[string]string{},
 		disabledLogger,
 	)
 
@@ -90,6 +91,7 @@ func TestStrictNoLogging_RequestContext_LoggerIntegration(t *testing.T) {
 		map[string]string{"enabled": "true"},
 		map[string]string{},
 		map[string]string{},
+		map[string]string{},
 		enabledLogger,
 	)
 

From dbe7640f17a91abffd6d6e68ca8c9be2a18acc5c Mon Sep 17 00:00:00 2001
From: Maciek <tomczukmaciej@gmail.com>
Date: Fri, 12 Jun 2026 13:29:20 +0200
Subject: [PATCH 13/15] feat(app): add DNS rebinding protection toggle to
 Security tab

Signed-off-by: Maciek <tomczukmaciej@gmail.com>
---
 .../pages/blocklists/MainContentSection.tsx   |  43 ++++++
 .../blocklists/SecurityContentSection.tsx     | 141 ++++++++++++++----
 2 files changed, 152 insertions(+), 32 deletions(-)

diff --git a/app/src/pages/blocklists/MainContentSection.tsx b/app/src/pages/blocklists/MainContentSection.tsx
index 35508184..e406d1c6 100644
--- a/app/src/pages/blocklists/MainContentSection.tsx
+++ b/app/src/pages/blocklists/MainContentSection.tsx
@@ -21,6 +21,8 @@ import {
 import { Skeleton } from "@/components/ui/skeleton";
 import {
     ApiV1BlocklistsGetSortByEnum,
+    ModelProfileUpdateOperationEnum,
+    ModelProfileUpdatePathEnum,
     type ApiBlocklistsUpdates,
     type ModelBlocklist,
 } from "@/api/client/api";
@@ -93,6 +95,7 @@ export default function MainContentSection(): JSX.Element {
     const [blocklists, setBlocklists] = useState<ModelBlocklist[]>([]);
     const [loading, setLoading] = useState(true);
     const [updating, setUpdating] = useState<string | null>(null);
+    const [rebindingUpdating, setRebindingUpdating] = useState(false);
     const [searchValue, setSearchValue] = useState("");
     const [filterValue, setFilterValue] = useState("all");
     const [sortValue, setSortValue] = useState<ApiV1BlocklistsGetSortByEnum>(ApiV1BlocklistsGetSortByEnum.Updated);
@@ -245,6 +248,43 @@ export default function MainContentSection(): JSX.Element {
         }
     };
 
+    // DNS rebinding protection — per-profile Security toggle stored in
+    // settings.security.rebinding_protection.enabled (default off).
+    const rebindingEnabled =
+        activeProfile?.settings?.security?.rebinding_protection?.enabled ?? false;
+
+    const handleRebindingToggle = async (enabled: boolean) => {
+        if (!activeProfile?.profile_id) return;
+        setRebindingUpdating(true);
+        try {
+            const resp = await api.Client.profilesApi.apiV1ProfilesIdPatch(
+                activeProfile.profile_id,
+                {
+                    updates: [
+                        {
+                            operation: ModelProfileUpdateOperationEnum.Replace,
+                            path: ModelProfileUpdatePathEnum.SettingsSecurityRebindingProtectionEnabled,
+                            value: enabled as unknown as object,
+                        },
+                    ],
+                }
+            );
+            if (resp && resp.status === 200) {
+                const updatedProfile = await api.Client.profilesApi.apiV1ProfilesIdGet(activeProfile.profile_id);
+                setActiveProfile(updatedProfile.data);
+                toast.success(
+                    enabled ? "DNS rebinding protection enabled" : "DNS rebinding protection disabled"
+                );
+            }
+        } catch {
+            toast.error("Error", {
+                description: "Failed to update DNS rebinding protection. Please try again.",
+            });
+        } finally {
+            setRebindingUpdating(false);
+        }
+    };
+
     // Split blocklists by `kind`: general lists (Lists tab), security lists
     // (Security tab) and content categories (Categories tab).
     const regularBlocklists = blocklists.filter(
@@ -594,6 +634,9 @@ export default function MainContentSection(): JSX.Element {
                             updating={updating}
                             loading={loading}
                             restricted={isRestricted}
+                            rebindingEnabled={rebindingEnabled}
+                            onRebindingToggle={handleRebindingToggle}
+                            rebindingUpdating={rebindingUpdating}
                         />
                     ) : null}
                 </TabsContent>
diff --git a/app/src/pages/blocklists/SecurityContentSection.tsx b/app/src/pages/blocklists/SecurityContentSection.tsx
index 5b78092d..daa21c0d 100644
--- a/app/src/pages/blocklists/SecurityContentSection.tsx
+++ b/app/src/pages/blocklists/SecurityContentSection.tsx
@@ -1,9 +1,12 @@
-import { type JSX } from "react";
+import { type ComponentType, type JSX, type ReactNode } from "react";
 import BlocklistCard from "./BlocklistCard";
 import NrdRangeCard from "./NrdRangeCard";
 import { isNrdItem, orderedNrdItems } from "./nrdGroup";
 import { ScrollArea } from "@/components/ui/scroll-area";
 import { Skeleton } from "@/components/ui/skeleton";
+import { Card, CardContent } from "@/components/ui/card";
+import { Switch } from "@/components/ui/switch";
+import { ShieldCheck, ShieldAlert } from "lucide-react";
 import type { ModelBlocklist } from "@/api/client/api";
 import { formatUpdatedRelative } from "./MainContentSection";
 
@@ -16,12 +19,40 @@ interface SecurityContentSectionProps {
     updating: string | null;
     loading: boolean;
     restricted?: boolean;
+    /** DNS rebinding protection per-profile toggle (settings.security.rebinding_protection.enabled). */
+    rebindingEnabled: boolean;
+    onRebindingToggle: (enabled: boolean) => void;
+    rebindingUpdating: boolean;
 }
 
 /**
- * Security tab — threat-protection blocklists (kind="security"). Renders the
- * Hagezi NRD windows as a single range card and every other security list (e.g.
- * Threat Intelligence Feeds) as an individual toggle card.
+ * Group header for the Security tab. A left-aligned uppercase label with a tinted
+ * icon and a trailing gradient hairline — reuses the visual vocabulary of the
+ * connector bars in CategoriesContentSection so the tabs feel consistent.
+ */
+function SectionLabel({
+    icon: Icon,
+    children,
+}: {
+    icon: ComponentType<{ className?: string }>;
+    children: ReactNode;
+}): JSX.Element {
+    return (
+        <div className="flex items-center gap-2 px-1 w-full select-none">
+            <div className="flex items-center gap-1.5 text-[11px] font-medium uppercase tracking-wider text-[var(--tailwind-colors-slate-400)]">
+                <Icon className="h-3.5 w-3.5 text-[var(--tailwind-colors-rdns-600)]/70" />
+                {children}
+            </div>
+            <div className="h-px flex-1 bg-gradient-to-r from-[var(--tailwind-colors-rdns-600)]/30 via-[var(--tailwind-colors-slate-700)]/40 to-transparent" />
+        </div>
+    );
+}
+
+/**
+ * Security tab — split into two groups: "DNS Protection" (behavioural safeguards
+ * like DNS rebinding protection) and "Threat Blocklists" (subscribable domain
+ * lists: the Hagezi NRD range card plus individual security lists such as Threat
+ * Intelligence Feeds and CERT.pl).
  */
 export default function SecurityContentSection({
     blocklists,
@@ -31,16 +62,21 @@ export default function SecurityContentSection({
     updating,
     loading,
     restricted = false,
+    rebindingEnabled,
+    onRebindingToggle,
+    rebindingUpdating,
 }: SecurityContentSectionProps): JSX.Element {
     const nrdItems = orderedNrdItems(blocklists);
     const regularItems = blocklists.filter((bl) => !isNrdItem(bl));
+    const hasBlocklists = nrdItems.length > 0 || regularItems.length > 0;
 
     return (
         <div className="flex flex-col w-full items-start gap-6">
             <section className="w-full">
                 <p className="text-[var(--tailwind-colors-slate-200)] text-base leading-6">
-                    Security blocklists protect against malware, phishing, scams and
-                    other threats. Threat Intelligence Feeds is enabled by default.
+                    Defend this profile against malware, phishing, scams, and
+                    DNS-based attacks on your local network. Threat Intelligence
+                    Feeds is enabled by default.
                 </p>
             </section>
 
@@ -60,34 +96,75 @@ export default function SecurityContentSection({
                             ))}
                         </div>
                     ) : (
-                        <div className="grid grid-cols-1 sm:grid-cols-2 md:grid-cols-3 xl:grid-cols-4 gap-6 pb-8">
-                            {nrdItems.length > 0 && (
-                                <div className="col-span-1 sm:col-span-2 md:col-span-3 xl:col-span-4">
-                                    <NrdRangeCard
-                                        items={nrdItems}
-                                        enabledBlocklists={enabledBlocklists}
-                                        onApplySet={onApplySet}
-                                        updating={updating}
-                                        restricted={restricted}
+                        <div className="flex flex-col gap-4 pb-8 w-full">
+                            {/* Group 1 — behavioural protections (not subscribable lists) */}
+                            <SectionLabel icon={ShieldCheck}>DNS Protection</SectionLabel>
+                            <Card
+                                data-testid="rebinding-protection-card"
+                                className="bg-transparent dark:bg-[var(--variable-collection-surface)] p-3 border border-[var(--tailwind-colors-slate-light-300)] dark:border-transparent rounded-[var(--tailwind-primitives-border-radius-rounded)] shadow-sm w-full overflow-hidden"
+                            >
+                                <CardContent className="p-0 flex items-start justify-between gap-4">
+                                    <div className="flex flex-col gap-2 min-w-0">
+                                        <div className="text-tailwind-colors-slate-50 font-semibold text-base leading-tight">
+                                            DNS Rebinding Protection
+                                        </div>
+                                        <div className="font-text-xs-leading-5-normal text-[var(--tailwind-colors-slate-100)] text-xs break-words">
+                                            Block responses where a public domain resolves to a private or
+                                            local IP address (e.g. 192.168.x.x, 127.0.0.1), a technique used
+                                            in DNS rebinding attacks to reach devices on your network.
+                                        </div>
+                                    </div>
+                                    <Switch
+                                        data-testid="rebinding-protection-switch"
+                                        checked={rebindingEnabled}
+                                        onCheckedChange={onRebindingToggle}
+                                        disabled={rebindingUpdating || restricted}
+                                        className="w-9 h-5 flex-shrink-0
+                                        data-[state=unchecked]:bg-[var(--tailwind-colors-slate-700)]
+                                        data-[state=checked]:bg-[var(--tailwind-colors-rdns-600)]
+                                        [&>[data-slot=switch-thumb]]:bg-background
+                                        data-[state=checked]:[&>[data-slot=switch-thumb]]:bg-[var(--tailwind-colors-slate-50)]
+                                        data-[state=unchecked]:[&>[data-slot=switch-thumb]]:bg-[var(--tailwind-colors-slate-400)]
+                                        data-[state=checked]:[&>[data-slot=switch-thumb]]:translate-x-4"
                                     />
-                                </div>
+                                </CardContent>
+                            </Card>
+
+                            {/* Group 2 — subscribable threat blocklists */}
+                            {hasBlocklists && (
+                                <>
+                                    <SectionLabel icon={ShieldAlert}>Threat Blocklists</SectionLabel>
+                                    <div className="grid grid-cols-1 sm:grid-cols-2 md:grid-cols-3 xl:grid-cols-4 gap-6">
+                                        {nrdItems.length > 0 && (
+                                            <div className="col-span-1 sm:col-span-2 md:col-span-3 xl:col-span-4">
+                                                <NrdRangeCard
+                                                    items={nrdItems}
+                                                    enabledBlocklists={enabledBlocklists}
+                                                    onApplySet={onApplySet}
+                                                    updating={updating}
+                                                    restricted={restricted}
+                                                />
+                                            </div>
+                                        )}
+                                        {regularItems.map((bl) => {
+                                            const isEnabled = enabledBlocklists.includes(bl.blocklist_id);
+                                            return (
+                                                <BlocklistCard
+                                                    key={bl.blocklist_id}
+                                                    title={bl.name}
+                                                    description={bl.description}
+                                                    entries={bl.entries}
+                                                    updated={formatUpdatedRelative(bl.last_modified)}
+                                                    onSwitchChange={(checked) => onToggle(bl.blocklist_id, checked)}
+                                                    switchChecked={isEnabled}
+                                                    switchDisabled={updating === bl.blocklist_id || restricted}
+                                                    homepage={bl.homepage}
+                                                />
+                                            );
+                                        })}
+                                    </div>
+                                </>
                             )}
-                            {regularItems.map((bl) => {
-                                const isEnabled = enabledBlocklists.includes(bl.blocklist_id);
-                                return (
-                                    <BlocklistCard
-                                        key={bl.blocklist_id}
-                                        title={bl.name}
-                                        description={bl.description}
-                                        entries={bl.entries}
-                                        updated={formatUpdatedRelative(bl.last_modified)}
-                                        onSwitchChange={(checked) => onToggle(bl.blocklist_id, checked)}
-                                        switchChecked={isEnabled}
-                                        switchDisabled={updating === bl.blocklist_id || restricted}
-                                        homepage={bl.homepage}
-                                    />
-                                );
-                            })}
                         </div>
                     )}
                 </ScrollArea>

From 1e0bcee8d7b66f27d40bfb50590ee4a580ba527d Mon Sep 17 00:00:00 2001
From: Maciek <tomczukmaciej@gmail.com>
Date: Fri, 12 Jun 2026 15:46:50 +0200
Subject: [PATCH 14/15] fix(proxy): read rebinding toggle with ParseBool
 (go-redis stores bool as \"1\")

Signed-off-by: Maciek <tomczukmaciej@gmail.com>
---
 proxy/filter/cross_phase_aggregation_test.go | 2 +-
 proxy/filter/rebinding.go                    | 7 +++++--
 proxy/filter/rebinding_benchmark_test.go     | 2 +-
 proxy/filter/rebinding_test.go               | 9 +++++++--
 4 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/proxy/filter/cross_phase_aggregation_test.go b/proxy/filter/cross_phase_aggregation_test.go
index e86b6d62..6a95da34 100644
--- a/proxy/filter/cross_phase_aggregation_test.go
+++ b/proxy/filter/cross_phase_aggregation_test.go
@@ -426,7 +426,7 @@ func TestIPFilter_RebindingCrossPhase(t *testing.T) {
 			ipFilter := NewIPFilter(&proxy.Proxy{}, mockCache, nil, nil, defaultRebindingConfig())
 
 			reqCtx := newTestReqCtx(t, profileID)
-			reqCtx.RebindingProtectionSettings = map[string]string{"enabled": "true"}
+			reqCtx.RebindingProtectionSettings = map[string]string{"enabled": "1"}
 			reqCtx.PartialFilteringResults = append(reqCtx.PartialFilteringResults, tt.domainResults...)
 
 			err := ipFilter.Execute(reqCtx, dnsCtxWithAAnswer(t, "192.168.1.1"))
diff --git a/proxy/filter/rebinding.go b/proxy/filter/rebinding.go
index e06f7064..6594dc0e 100644
--- a/proxy/filter/rebinding.go
+++ b/proxy/filter/rebinding.go
@@ -1,6 +1,7 @@
 package filter
 
 import (
+	"strconv"
 	"strings"
 
 	"github.com/AdguardTeam/dnsproxy/proxy"
@@ -39,8 +40,10 @@ func (f *IPFilter) filterRebinding(reqCtx *requestcontext.RequestContext, dctx *
 		return result, nil
 	}
 
-	// Per-profile opt-in (default OFF). Absent/empty hash → not enabled.
-	if reqCtx.RebindingProtectionSettings[rebindingEnabledKey] != "true" {
+	// Per-profile opt-in (default OFF). The API stores the bool via go-redis,
+	// which serializes true as "1" (not "true"), so parse rather than compare —
+	// mirrors how server.go reads DNSSEC settings. Absent/empty/false → not enabled.
+	if enabled, _ := strconv.ParseBool(reqCtx.RebindingProtectionSettings[rebindingEnabledKey]); !enabled {
 		return result, nil
 	}
 
diff --git a/proxy/filter/rebinding_benchmark_test.go b/proxy/filter/rebinding_benchmark_test.go
index 53b9756e..42af40f0 100644
--- a/proxy/filter/rebinding_benchmark_test.go
+++ b/proxy/filter/rebinding_benchmark_test.go
@@ -54,7 +54,7 @@ func BenchmarkFilterRebinding(b *testing.B) {
 			reqCtx := &requestcontext.RequestContext{
 				ProfileId:                   "bench",
 				Logger:                      loggerFactory.ForProfile("bench", false),
-				RebindingProtectionSettings: map[string]string{"enabled": "true"},
+				RebindingProtectionSettings: map[string]string{"enabled": "1"},
 			}
 			dctx := benchRebindingCtx(tc.answers, tc.private)
 
diff --git a/proxy/filter/rebinding_test.go b/proxy/filter/rebinding_test.go
index d62fb9c5..d349bd94 100644
--- a/proxy/filter/rebinding_test.go
+++ b/proxy/filter/rebinding_test.go
@@ -50,7 +50,10 @@ func defaultRebindingConfig() *config.RebindingConfig {
 // T150). Rows trace to docs/specs/proxy-filtering-behaviour.md "DNS rebinding
 // protection" decision table.
 func TestFilterRebinding(t *testing.T) {
-	enabled := map[string]string{"enabled": "true"}
+	// The API persists the toggle via go-redis, which serializes bool true as "1"
+	// (not "true"). Use "1" as the canonical enabled value so these tests reflect
+	// what the proxy actually reads from Redis; R1b covers the "true" spelling too.
+	enabled := map[string]string{"enabled": "1"}
 
 	tests := []struct {
 		name     string
@@ -67,6 +70,8 @@ func TestFilterRebinding(t *testing.T) {
 		{"R1 loopback 127/8 blocked", "R1", defaultRebindingConfig(), enabled, dnsCtxWithAAnswer(t, "127.0.0.1"), model.DecisionBlock},
 		{"R1 link-local 169.254/16 blocked", "R1", defaultRebindingConfig(), enabled, dnsCtxWithAAnswer(t, "169.254.1.1"), model.DecisionBlock},
 		{"R1 unspecified 0/8 blocked", "R1", defaultRebindingConfig(), enabled, dnsCtxWithAAnswer(t, "0.0.0.0"), model.DecisionBlock},
+		// Enabled value robustness: both go-redis "1" and a literal "true" enable it.
+		{"R1b enabled=true also blocks", "R1", defaultRebindingConfig(), map[string]string{"enabled": "true"}, dnsCtxWithAAnswer(t, "192.168.1.1"), model.DecisionBlock},
 
 		// Always-private IPv6 ranges.
 		{"R2 IPv6 loopback ::1 blocked", "R2", defaultRebindingConfig(), enabled, dnsCtxWithAAnswer(t, "::1"), model.DecisionBlock},
@@ -130,7 +135,7 @@ func TestFilterRebinding(t *testing.T) {
 // TestFilterRebinding_HTTPSHint verifies private IPs in HTTPS/SVCB ipv4hint are caught.
 func TestFilterRebinding_HTTPSHint(t *testing.T) {
 	reqCtx := newTestReqCtx(t, "rebinding-https")
-	reqCtx.RebindingProtectionSettings = map[string]string{"enabled": "true"}
+	reqCtx.RebindingProtectionSettings = map[string]string{"enabled": "1"}
 	f := &IPFilter{RebindingConfig: defaultRebindingConfig()}
 
 	dctx := dnsCtxWithHTTPSAnswer(t, "evil.com.", []net.IP{net.ParseIP("192.168.1.1")}, nil)

From bf1eca3f6617cedfdd5df54f4e3b6bd3fa695f9b Mon Sep 17 00:00:00 2001
From: Maciek <tomczukmaciej@gmail.com>
Date: Fri, 12 Jun 2026 15:50:10 +0200
Subject: [PATCH 15/15] test(e2e): cover DNS rebinding protection end-to-end

---
 tests/config/testhosts.txt                   |  10 +-
 tests/dns_tests/test_rebinding_protection.py | 263 +++++++++++++++++++
 2 files changed, 272 insertions(+), 1 deletion(-)
 create mode 100644 tests/dns_tests/test_rebinding_protection.py

diff --git a/tests/config/testhosts.txt b/tests/config/testhosts.txt
index d93e8a8a..eaa1b10a 100644
--- a/tests/config/testhosts.txt
+++ b/tests/config/testhosts.txt
@@ -3,4 +3,12 @@
 104.18.74.230 test.com
 212.77.99.7 ads.wp.pl
 # Services/ASN blocking tests — 8.8.8.8 is always AS15169 (Google) in GeoIP.
-8.8.8.8 svctest-google.com
\ No newline at end of file
+8.8.8.8 svctest-google.com
+# DNS rebinding protection tests — public names deliberately mapped to private IPs
+# so the proxy IP-phase rebinding filter can be exercised deterministically (A only;
+# IPv6/CGNAT/NAT64 are covered by Go unit tests in proxy/filter/rebinding_test.go).
+192.168.0.10 rebinding-private-v4.com
+10.0.0.10 rebinding-private-10.com
+127.0.0.1 rebinding-loopback.com
+192.168.0.20 rebinding-allow-rule.com
+192.168.0.30 router.local
\ No newline at end of file
diff --git a/tests/dns_tests/test_rebinding_protection.py b/tests/dns_tests/test_rebinding_protection.py
new file mode 100644
index 00000000..59b2da46
--- /dev/null
+++ b/tests/dns_tests/test_rebinding_protection.py
@@ -0,0 +1,263 @@
+"""End-to-end integration tests for DNS rebinding protection.
+
+These tests validate the *integration seam* that the Go unit tests
+(`proxy/filter/rebinding_test.go`, rows R1-R12) cannot exercise: the API client
+PATCHes `/settings/security/rebinding_protection/enabled`, the API writes the
+`settings:<id>:security:rebinding_protection` Redis hash, the proxy batch-fetch
+reads it into the request context, and the IP-phase filter (TierRebinding, T150)
+produces the right answer over the real DoH wire path.
+
+Determinism comes from `config/testhosts.txt`, which maps public-looking names to
+private IPs via the sdns hostsfile (sdns returns them unmodified). The proxy master
+switch defaults ON in the test env (`REBINDING_PROTECTION_ENABLED` unset), and
+`PROFILE_SETTINGS_CACHE_TTL=1ms` makes per-profile toggles visible on the next query.
+
+Deliberately out of scope here (covered by Go unit tests, not drivable through the
+IPv4-only hostsfile / build-time env): IPv6 ranges (::1, fc00::/7, fe80::/10), the
+::ffff: IPv4-mapped unwrap, HTTPS/SVCB ipv4hint, and the env-gated CGNAT (100.64/10)
+and NAT64 (64:ff9b::/96) ranges.
+
+specRef rows refer to docs/specs/proxy-filtering-behaviour.md Section E (R1-R12).
+"""
+
+import pytest
+from libs.dns_lib import DNSLib
+from libs.settings import get_settings
+from dns.rdatatype import A
+
+import moddns.api_client as client
+import moddns.api as api
+import moddns.configuration as api_config
+from moddns import (
+    RequestsProfileUpdates,
+    ModelProfileUpdate,
+    RequestsCreateProfileCustomRuleBody,
+    ApiCreateProfileBody,
+)
+
+# testhosts.txt mappings (public name -> private IP) used by these tests.
+PRIVATE_V4_DOMAIN = "rebinding-private-v4.com"
+PRIVATE_V4_IP = "192.168.0.10"
+LOOPBACK_DOMAIN = "rebinding-loopback.com"
+ALLOW_RULE_DOMAIN = "rebinding-allow-rule.com"
+ALLOW_RULE_IP = "192.168.0.20"
+ALLOW_SUFFIX_DOMAIN = "router.local"  # ends in .local -> operator allow-suffix
+ALLOW_SUFFIX_IP = "192.168.0.30"
+PUBLIC_DOMAIN = "svctest-google.com"  # -> 8.8.8.8 (public), already in testhosts.txt
+PUBLIC_IP = "8.8.8.8"
+
+BLOCKED_A = "0.0.0.0"
+
+
+class TestRebindingProtection:
+    """End-to-end tests for the per-profile DNS rebinding protection toggle.
+
+    Each test creates an isolated profile to avoid cross-test interference.
+    """
+
+    def setup_class(self):
+        self.config = get_settings()
+        self.api_config = api_config.Configuration(host=self.config.DNS_API_ADDR)
+        self.dns_lib = DNSLib(self.config.DOH_ENDPOINT)
+
+    def _create_profile(self, profiles_instance, name):
+        """Create a new profile and return its ID."""
+        body = ApiCreateProfileBody(name=name)
+        resp = profiles_instance.api_v1_profiles_post_with_http_info(body=body)
+        assert (
+            resp.status_code == 201
+        ), f"Failed to create profile with status code: {resp.status_code}"
+        return resp.data.profile_id
+
+    def _create_custom_rule(self, profiles_instance, profile_id, action, value):
+        """Create a custom rule (action: 'allow' | 'block') on a profile."""
+        custom_rule_body = RequestsCreateProfileCustomRuleBody(
+            action=action, value=value
+        )
+        resp = profiles_instance.api_v1_profiles_id_custom_rules_post_with_http_info(
+            id=profile_id, body=custom_rule_body
+        )
+        assert (
+            resp.status_code == 201
+        ), f"Custom rule creation failed for {value} with status code: {resp.status_code}"
+        return resp
+
+    def _set_rebinding_protection(self, profiles_instance, profile_id, enabled: bool):
+        """Toggle settings.security.rebinding_protection.enabled via PATCH."""
+        update_request = RequestsProfileUpdates(
+            updates=[
+                ModelProfileUpdate(
+                    operation="replace",
+                    path="/settings/security/rebinding_protection/enabled",
+                    # Dict[string, Any] is an openapi-cli-gen limitation — the Go
+                    # 'interface{}' type is generated as Dict[string, Any].
+                    value={"value": enabled},
+                )
+            ]
+        )
+        resp = profiles_instance.api_v1_profiles_id_patch_with_http_info(
+            profile_id, body=update_request
+        )
+        assert (
+            resp.status_code == 200
+        ), f"Profile rebinding_protection update failed with status code: {resp.status_code}"
+        return resp
+
+    @staticmethod
+    def _answer_ip(resp):
+        """Return the first A-answer IP as a string."""
+        assert resp.answer, "Expected a DNS answer section"
+        return resp.answer[0].to_text().split(" ")[-1]
+
+    @pytest.mark.asyncio
+    async def test_default_off_passes_private_ip(self, create_account_and_login):
+        """specRef: R5 — opt-in default OFF: a fresh profile resolves a private IP
+        normally (rebinding protection is not enabled)."""
+        account, cookie = create_account_and_login
+        with client.ApiClient(self.api_config) as api_client:
+            profiles_instance = api.ProfileApi(api_client)
+            profiles_instance.api_client.default_headers["Cookie"] = cookie
+            profile_id = self._create_profile(
+                profiles_instance, "rebinding_default_off"
+            )
+
+            resp = await self.dns_lib.send_doh_request(profile_id, PRIVATE_V4_DOMAIN, A)
+            ip = self._answer_ip(resp)
+            assert ip == PRIVATE_V4_IP, (
+                f"Default-off profile should resolve {PRIVATE_V4_DOMAIN} to "
+                f"{PRIVATE_V4_IP}, got {ip}"
+            )
+
+    @pytest.mark.asyncio
+    async def test_enabled_blocks_private_192168(self, create_account_and_login):
+        """specRef: R1 — enabled: a public name resolving to 192.168.x is blocked
+        (A -> 0.0.0.0)."""
+        account, cookie = create_account_and_login
+        with client.ApiClient(self.api_config) as api_client:
+            profiles_instance = api.ProfileApi(api_client)
+            profiles_instance.api_client.default_headers["Cookie"] = cookie
+            profile_id = self._create_profile(
+                profiles_instance, "rebinding_block_192168"
+            )
+            self._set_rebinding_protection(profiles_instance, profile_id, True)
+
+            resp = await self.dns_lib.send_doh_request(profile_id, PRIVATE_V4_DOMAIN, A)
+            ip = self._answer_ip(resp)
+            assert ip == BLOCKED_A, (
+                f"Expected {PRIVATE_V4_DOMAIN} blocked to {BLOCKED_A}, got {ip}"
+            )
+
+    @pytest.mark.asyncio
+    async def test_enabled_blocks_loopback(self, create_account_and_login):
+        """specRef: R1 — enabled: a public name resolving to 127.0.0.1 is blocked."""
+        account, cookie = create_account_and_login
+        with client.ApiClient(self.api_config) as api_client:
+            profiles_instance = api.ProfileApi(api_client)
+            profiles_instance.api_client.default_headers["Cookie"] = cookie
+            profile_id = self._create_profile(
+                profiles_instance, "rebinding_block_loopback"
+            )
+            self._set_rebinding_protection(profiles_instance, profile_id, True)
+
+            resp = await self.dns_lib.send_doh_request(profile_id, LOOPBACK_DOMAIN, A)
+            ip = self._answer_ip(resp)
+            assert ip == BLOCKED_A, (
+                f"Expected {LOOPBACK_DOMAIN} blocked to {BLOCKED_A}, got {ip}"
+            )
+
+    @pytest.mark.asyncio
+    async def test_disable_restores_resolution(self, create_account_and_login):
+        """specRef: R5 / seam — toggling the setting off restores normal resolution
+        (relies on PROFILE_SETTINGS_CACHE_TTL=1ms for immediate visibility)."""
+        account, cookie = create_account_and_login
+        with client.ApiClient(self.api_config) as api_client:
+            profiles_instance = api.ProfileApi(api_client)
+            profiles_instance.api_client.default_headers["Cookie"] = cookie
+            profile_id = self._create_profile(
+                profiles_instance, "rebinding_toggle"
+            )
+
+            self._set_rebinding_protection(profiles_instance, profile_id, True)
+            resp_blocked = await self.dns_lib.send_doh_request(
+                profile_id, PRIVATE_V4_DOMAIN, A
+            )
+            assert self._answer_ip(resp_blocked) == BLOCKED_A, "Expected block when enabled"
+
+            self._set_rebinding_protection(profiles_instance, profile_id, False)
+            resp_open = await self.dns_lib.send_doh_request(
+                profile_id, PRIVATE_V4_DOMAIN, A
+            )
+            ip = self._answer_ip(resp_open)
+            assert ip == PRIVATE_V4_IP, (
+                f"Expected resolution restored to {PRIVATE_V4_IP} after disable, got {ip}"
+            )
+
+    @pytest.mark.asyncio
+    async def test_custom_allow_overrides_rebinding(self, create_account_and_login):
+        """specRef: R12 — a user custom Allow rule (tier 200) overrides the rebinding
+        block (tier 150) via Allow-wins cross-phase aggregation."""
+        account, cookie = create_account_and_login
+        with client.ApiClient(self.api_config) as api_client:
+            profiles_instance = api.ProfileApi(api_client)
+            profiles_instance.api_client.default_headers["Cookie"] = cookie
+            profile_id = self._create_profile(
+                profiles_instance, "rebinding_custom_allow"
+            )
+            self._set_rebinding_protection(profiles_instance, profile_id, True)
+
+            resp_blocked = await self.dns_lib.send_doh_request(
+                profile_id, ALLOW_RULE_DOMAIN, A
+            )
+            assert self._answer_ip(resp_blocked) == BLOCKED_A, (
+                "Expected block before the custom allow rule"
+            )
+
+            self._create_custom_rule(
+                profiles_instance, profile_id, "allow", ALLOW_RULE_DOMAIN
+            )
+            resp = await self.dns_lib.send_doh_request(profile_id, ALLOW_RULE_DOMAIN, A)
+            ip = self._answer_ip(resp)
+            assert ip == ALLOW_RULE_IP, (
+                f"Custom allow rule should override rebinding block; expected "
+                f"{ALLOW_RULE_IP}, got {ip}"
+            )
+
+    @pytest.mark.asyncio
+    async def test_allow_suffix_bypass(self, create_account_and_login):
+        """specRef: R9 — names matching an operator allow-suffix (.local) resolve to a
+        private IP even when rebinding protection is enabled."""
+        account, cookie = create_account_and_login
+        with client.ApiClient(self.api_config) as api_client:
+            profiles_instance = api.ProfileApi(api_client)
+            profiles_instance.api_client.default_headers["Cookie"] = cookie
+            profile_id = self._create_profile(
+                profiles_instance, "rebinding_allow_suffix"
+            )
+            self._set_rebinding_protection(profiles_instance, profile_id, True)
+
+            resp = await self.dns_lib.send_doh_request(profile_id, ALLOW_SUFFIX_DOMAIN, A)
+            ip = self._answer_ip(resp)
+            assert ip == ALLOW_SUFFIX_IP, (
+                f"Allow-suffix domain {ALLOW_SUFFIX_DOMAIN} should resolve to "
+                f"{ALLOW_SUFFIX_IP}, got {ip}"
+            )
+
+    @pytest.mark.asyncio
+    async def test_public_ip_not_blocked(self, create_account_and_login):
+        """specRef: R4 — regression: a public IP answer is never blocked, so rebinding
+        protection does not break normal resolution."""
+        account, cookie = create_account_and_login
+        with client.ApiClient(self.api_config) as api_client:
+            profiles_instance = api.ProfileApi(api_client)
+            profiles_instance.api_client.default_headers["Cookie"] = cookie
+            profile_id = self._create_profile(
+                profiles_instance, "rebinding_public_ok"
+            )
+            self._set_rebinding_protection(profiles_instance, profile_id, True)
+
+            resp = await self.dns_lib.send_doh_request(profile_id, PUBLIC_DOMAIN, A)
+            ip = self._answer_ip(resp)
+            assert ip == PUBLIC_IP, (
+                f"Public domain {PUBLIC_DOMAIN} should resolve to {PUBLIC_IP} with "
+                f"rebinding enabled, got {ip}"
+            )