misp-warninglists/lists/automated-malware-analysis/list.json

{
  "name": "List of known domains used by automated malware analysis services",
  "version": 2,
  "description": "Domains used by automated malware analysis services",
  "type": "substring",
  "matching_attributes": [
    "domain",
    "hostname",
    "domain|ip",
    "url"
  ],
  "list": [
    "virustotal.com",
    "malwr.com",
    "hybrid-analysis.com",
    "emergingthreats.net",
    "joesandbox.com",
    "anlyz.io",
    "detux.org",
    "akana.mobiseclab.org",
    "sandbox.pikker.ee",
    "www.threatexpert.com",
    "www.vicheck.ca",
    "reverse.it"
  ]
}