All "Online Malicious URL Blocklist" list URLs seem to be so broken that they need to be removed

[DandelionSprout]

Prerequisites

• I verified that this is not a filter list issue. Report any issues with filter lists or broken website functionality in the uAssets issue tracker.
• This is not a support issue or a question. For support, questions, or help, visit /r/uBlockOrigin.
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue.
• The issue is not present after disabling uBO in the browser.
• I checked the documentation to understand that the issue I am reporting is not normal behavior.

I tried to reproduce the issue when...

• uBO is the only extension.
• uBO uses default lists and settings.
• using a new, unmodified browser profile.

Description

As of at the time of writing (02:52 UTC), all three CDN mirrors used for "Online Malicious URL Blocklist" are very broken to the point of needing to be removed or replaced at the first opportunity.

• https://curbengh.github.io/malware-filter/urlhaus-filter-online.txt has a top entry that is simply 106. It was apparently previously 61 earlier tonight.
• https://malware-filter.pages.dev/urlhaus-filter-online.txt has an entry that is simply 1106 (on row 1106, for that matter).
• https://malware-filter.gitlab.io/malware-filter/urlhaus-filter-online.txt seem to have very heavy downtime. I wager a guess at 70% downtime tonight.

Other list versions hosted on the first two mirrors also have strange but different faulty entries, so something is very amiss.

A specific URL where the issue occurs.

https://curbengh.github.io/malware-filter/urlhaus-filter-online.txt

Steps to Reproduce

1. In uBO's settings, sync Online Malicious URL Blocklist until one of the two faulty mirrors are used. Shouldn't take too long if the third mirror's downtime continues.
2. Open chrome-extension://cjpalhdlnbpafiamejdnhcphjbkeiagm/asset-viewer.html?url=urlhaus-1
3. Look for overly short entries.

Expected behavior

I'm not 100% sure. The most ideal would be if Curben fixed his mirrors and/or scripts, but I doubt the viability of his list and its maintenance by now.

Actual behavior

The list in question contains faulty entries that are simply too short.

uBO version

1.51.0

Browser name and version

Chrome 115.0.5790.170 x64

Operating System and version

Windows 11 22H2 x64

[uBlock-user]

gorhill/uBlock@7de61bb

phishing-filter.txt is optional, urlhaus-filter-online.txt is enabled by default.

https://gitlab.com/malware-filter/urlhaus-filter/-/issues/89

@gorhill

---

Mirrors 3, 4 and 6 looks good(?)

[Yuki2718]

On uBO the rules will be treated as ||61^, ||106^ so the impact is less than that adblocker, but still any IP ending with them will be blocked.

[gorhill]

All three mirrors load fine on my side. I just changed the main URL for both Online Malicious URL Blocklist and PUP Domains Blocklist, like I did yesterday for Phishing URL Blocklist.

[gorhill]

Mirrors 3, 4 and 6

What are these?

---

Never mind, here: https://gitlab.com/malware-filter/urlhaus-filter

[zdev-code]

Can confirm this list is busted, currently blocks github!

[DandelionSprout]

Though today's incident is technically different from the one from 2 years ago, it's nevertheless being noted and then some at https://gitlab.com/malware-filter/urlhaus-filter/-/issues/111.

[Yuki2718]

@DandelionSprout Sorry, is it possible for you to open an issue ticket about uBlockOrigin/uAssets@c8662fc on the Gitlab? I don't have an account there.