It looks like this [1] I enable query logging to a tmpfs RAM disk and then every month I update a list of domains that I have queries more than {n} times. I mix that in with a list of the Cloudflare top 20K domains after removing the broken ones and some TLD's.

[1] - https://nochan.net/b/Internet-Crap/20260602-Set-Up-Your-Own-...