Can anyone recommend a relevant public malware domain list?

[AlexeySh]

Hello,

I find that the default malware domain list used by Splunk ES (that of malwaredomains.com) is not very relevant: it contains a lot of business services, new sites, etc., so ES generates a lot of false positives.

I’d like to know if anyone has experience of using any other public malware domain lists and/or if there are some you could recommend.

Thanks for the help.

Regards,
Alexey.

[kchamplin_splun]

Hello @AlexeySh - while I don't have any recommendations for free malware domain lists (hopefully others will chime in). That said, do you have some examples of false positives that are on the list that are showing up?

[AlexeySh]

Hello @kchamplin [Splunk],

Sure, here is some detection we had recently:

widoobiz.com – broadcast Media
mon-poeme.fr – leisure website
mlsend.com – business communication
safelinks.protection.outlook.com – webmail
gandi.net – domain name management

Fortunately, we do not have a huge volume of false positives, but still there is always some legitimate websites detected every week including a new ones so it’s kind of hard to whitelist.

Regards,
Alexey.