Data
What we know, and what we do not.
Every entry carries a source and a stated consequence. The gaps are listed too, because a catalogue that hides its holes is not much use to anyone deciding whether to trust it.
documented endpoints across 15 vendors
domains that break a television, published as an allowlist
crowdsourced reports merged. A row is published once five separate contributors have reported it.
By purpose
| Purpose | Entries | Safe to block |
|---|---|---|
| Content recognition | 10 | all |
| Advertising | 40 | all |
| Telemetry and diagnostics | 87 | 86 of 87 |
| Needed for the device to work | 43 | none |
| Firmware updates | 17 | none |
| Content delivery | 6 | none |
| Time synchronisation | 6 | none |
By vendor
| Vendor | Blockable | Do not block | Recognition endpoints |
|---|---|---|---|
| amazon | 21 | 9 | none documented |
| apple | 11 | 11 | none documented |
| 7 | 8 | none documented | |
| hisense | 1 | 4 | none documented |
| lg | 25 | 9 | 1 |
| multiple | 1 | 2 | none documented |
| panasonic | 3 | 3 | none documented |
| philips | 3 | 3 | none documented |
| roku | 17 | 2 | 1 |
| samsung | 28 | 13 | 3 |
| sharp | 0 | 2 | none documented |
| sony | 9 | 4 | 2 |
| toshiba | 1 | 0 | none documented |
| vizio | 5 | 3 | 3 |
| xiaomi | 4 | 0 | none documented |
The do-not-block list
The part of this catalogue with no good equivalent elsewhere. A blocklist is easy to write. Working out which entries break the app store, the firmware updater, the programme guide or the clock takes evidence, and several widely used lists get it wrong.
| Domain | Blocking it breaks |
|---|---|
api.amazon.com | The device stops working. PETS 2021 lists this as required, and it also appears on their non-required list because it multiplexes both kinds of traffic. Multiplexed hosts cannot be blocked at DNS level without collateral damage. |
unagi-eu.amazon.com | The device stops working. Classified required by PETS 2021. |
mas-ext.amazon.com | Apps cannot be installed. |
amazonadsi-a.akamaihd.net | App installation and updates fail. |
softwareupdates.amazon.com | Firmware updates fail. |
ftv-smp.ntp-fireos.com | The clock drifts and certificate validation starts failing. |
2.android.pool.ntp.org | The clock drifts and certificate validation starts failing. |
amazonalexa.com | Alexa voice control stops working. |
amazonaws.com | Wide collateral damage. Perflyst warns that device push messaging uses per-device certificates on shared AWS address space, so a blanket block takes out unrelated services. |
mesu.apple.com | Software updates fail. |
gdmf.apple.com | Software updates fail. |
gs.apple.com | Software updates and activation fail. |
albert.apple.com | Device activation fails, which can leave a factory-reset Apple TV unusable. |
itunes.apple.com | The App Store and media playback stop working. |
apps.apple.com | The App Store stops working. |
mzstatic.com | App Store artwork stops loading. |
ocsp.apple.com | Certificate validation fails, which can break app launches. |
valid.apple.com | Certificate validation fails. |
push.apple.com | Push notifications and several system services stop working. |
guzzoni.apple.com | Siri stops working. Block it deliberately if you do not want Siri. |
googleapis.com | Play Store, app updates, DRM licensing and sign-in all fail. The three platform telemetry hosts under this domain are listed individually above. Block those, not the parent. |
play.google.com | The Play Store stops working. |
gvt1.com | App downloads and updates fail. |
android.apis.google.com | Device check-in and account sync fail. |
Showing 24 of 73.The full list, in AdGuard allowlist syntax.
Where our data is thin
Computed from the catalogue rather than asserted, so this section cannot quietly go stale while coverage stays poor.
| Vendor | Blockable entries |
|---|---|
| sharp | 0 |
| hisense | 1 |
| multiple | 1 |
| toshiba | 1 |
| panasonic | 3 |
| philips | 3 |
| xiaomi | 4 |
| vizio | 5 |
| 7 |
The clearest gap is Google and Android TV. There is no HaGeZi native blocklist for that platform, the community has isolated only three platform telemetry hostnames, and Google's own telemetry shares domains with hosts that the Play Store and DRM need. If you own a Google TV and can capture its traffic, that is the single most useful contribution available.
Open questions
Things the research could not establish. Each is a good first contribution, and each is the reason a corresponding claim is absent from the guides rather than hedged.
- Three figures circulate widely with no primary source: a 50-hour webOS developer session, a two-to-three month Tizen certificate expiry, and the claim that firmware updates silently re-enable content recognition. We publish none of them. The third is measurable, and measuring it would be an original finding.
- Whether Samsung and LG televisions use hardcoded DNS-over-HTTPS endpoints. The only source making specific claims has unpublished captures and reads as generated content, so we do not cite it.
- Almost nobody publishes hardcoded IP addresses, the ones a television dials without a DNS lookup. Two addresses from one rooted set is the state of public knowledge, and DNS filtering cannot touch them.
- Per-manufacturer availability of the Private DNS setting on Android TV, which has no interface in stock builds.
- Menu paths for Philips Titan OS, Panasonic My Home Screen, and several console platforms.
- Whether the widely documented VPN consent dialog trap on Google TV also applies to Fire OS. It matters because removing that package permanently prevents any traffic observer from working.
Licences
| What | Licence | Why |
|---|---|---|
| Blocklists | CC0 1.0 | Maximum uptake. If another list wants to absorb these entries, it should not have to ask or attribute. |
| Endpoint catalogue and guides | CC BY 4.0 | Reuse freely with credit. |
| Report corpus | ODbL 1.0 | Following Exodus Privacy. Volunteers contributed observations about their own homes, so derivatives should stay open to them. |
| Code | MIT | No reason to restrict it. |