add: automated-malware-analysis known domain list

Fix #45

README.md

@@ -10,6 +10,7 @@ are available in one of the list. The list can be globally enabled or disabled i
 # lists
 
 - [lists/alexa](lists/alexa) - Top 1000 websites from Alexa
+- [lists/automated-malware-analysis](lists/automated-malware-analysis) - known domains used by automated malware analysis services
 - [lists/eicar.com](lists/eicar.com) - hashes for EICAR test virus
 - [lists/empty-hashes](lists/empty-hashes) - hash values of empty files
 - [lists/google](lists/google) - known domains and hostnames from Google

lists/automated-malware-analysis/list.json

@@ -0,0 +1,25 @@
+{
+  "name": "List of known domains used by automated malware analysis services",
+  "version": 1,
+  "description": "Domains used by automated malware analysis services",
+  "type": "substring",
+  "matching_attributes": [
+    "domain",
+    "hostname",
+    "domain|ip",
+    "url"
+  ],
+  "list": [
+    "virustotal.com",
+    "malwr.com",
+    "hybrid-analysis.com",
+    "emergingthreats.net",
+    "joesandbox.com",
+    "anlyz.io",
+    "detux.org",
+    "akana.mobiseclab.org",
+    "sandbox.pikker.ee",
+    "www.threatexpert.com",
+    "www.vicheck.ca"
+  ]
+}