Cloudflare's malware blocking service is my go-to. 1.1.1.2, supporting DoH and DoT. I prefer them over Quad9 because Google blog post listed several malware domains and Quad9 only caught half, while Cloudflare caught them all.
https://www.reddit.com/r/Quad9/comments/t9b9v1/quad9_not_cat...