Table of Contents

Pi-Hole - Analytics

Top Queried Domains

sqlite3 /etc/pihole/pihole-FTL.db "SELECT DOMAIN, count(DOMAIN), STATUS FROM queries WHERE (STATUS == 2 OR STATUS == 3 OR STATUS == 12 OR STATUS == 13 OR STATUS == 14) GROUP BY DOMAIN ORDER BY count(DOMAIN) DESC LIMIT 15"

returns: 

discourse.pi-hole.net|183355|2
connectivitycheck.gstatic.com|164932|2
community.svc.ui.com|114747|2
www.msftncsi.com|86755|2
www.varia-store.com|81430|2
scontent.fgci1-1.fna.fbcdn.net|62595|2
dualstack.guardian.map.fastly.net|62480|2
192-168-1-5.c005b4ada9924bb388ab65319c17279c.plex.direct|60784|2
x2m8rwtfjg4j.statuspage.io|60064|2
nrdp.prod.ftl.netflix.com|54263|2
www.expressapisv2.net|51087|2
api-global.netflix.com|48880|2
fonts.gstatic.com.localdomain|43968|2
dmv2chczz9u6u.cloudfront.net|43510|2
star-mini.c10r.facebook.com|38378|3

NOTE: The request might take a very long time:

The STATUS values are:

  • 2: Allowed - Forwarded.
  • 3: Allowed - Known, replied to from cache
  • 12: Allowed - Retried query.
  • 13: Allowed - Retried but ignored query (this may happen during ongoing DNSSEC validation).
  • 14: Allowed - Already forwarded, not forwarding again.

See: https://docs.pi-hole.net/database/ftl/.

Top Blocked Domains

sqlite3 /etc/pihole/pihole-FTL.db "SELECT DOMAIN, count(DOMAIN), STATUS FROM queries WHERE (STATUS == 1 OR STATUS == 4 OR STATUS == 5 OR STATUS == 6 OR STATUS == 7 OR STATUS = 8 OR STATUS = 9 OR STATUS = 10 OR STATUS = 11) GROUP BY DOMAIN ORDER BY count(DOMAIN) DESC LIMIT 15"

returns: 

ichnaea.netflix.com|267968|1
ted.dailymail.co.uk|79297|1
t.dailymail.co.uk|79125|1
widget-mediator.zopim.com|73379|1
data.cnn.com|69864|1
prebid.adnxs.com|47370|1
ib.adnxs.com|47275|1
fonts.gstatic.com|44906|9
reports.crashlytics.com|35903|1
ads.adaptv.advertising.com|34109|1
fls-eu.amazon.co.uk|25136|1
tlu.dl.delivery.mp.microsoft.com|23841|1
status.geotrust.com|21949|1
analytics.plex.tv|21379|1
search.spotxchange.com|20253|1

References

https://docs.pi-hole.net/database/ftl/