Awesome

VXVault filterlist (unofficial)

Several filterlists created from VXVault's URL list. All credit to VXVault for the original data.<br> Note: VXVault seems to have been last updated over a month ago

What is VXVault filterlist & why does it exist?

VXVault filterlist takes the raw list of new malware URLs created by VXVault - which cannot be used in blockers (such as uBlock Origin) - and transforms it into a list compatible with uBlock Origin. All credit goes to vxvault.net for the original list.

Formats

• URLs for uBlock Origin/AdGuard <br> This is just the URLs which VXVault currently has in their "raw" list. This does not filter for false positives and will not include older URLs.
• All URLs in uBo format <br> This includes all of the URLs which have been added the VXVault since when this list was created. Thus, this list includes dead URLs and false positives which have been removed upstream. However, this also has the benifit of blocking older URLs which have fallen off the main list (VXVault only includes the latest 100 entries in the raw export).
• Domains <br>
• Domains in uBo format <br> This includes the domains of all the URLs currently listed in VXVault's raw export, with file hosting services and other safe domains excluded*.
• Domains in a HOSTs file <br> Just the format above, but as a HOSTs file and with IPs screened out.
• YARA rule <br> Just a YARA rule for finding files containing any of the VXVault URLs. Limited to the current (as of time of generation) URL list.
• SHA256s of downloaded files <br> Just a list of the SHA256s of the content returned by the VXVault URLs. This is not screened, so it may include 404 pages, Cloudflare, and other non-malware things the server decides to return.

* Using this allowlist. I would not put much faith in this allowlist as I add anything which "looks like file hosting and doesn't have hits on VT".