# malicious-hash: three text files that feed a FortiGate block list > malicious-hash aggregates malware hashes seen on malicious links into three plain text files, refreshed hourly and sized for FortiGate threat feeds. There is no code in the repository, only the data, the licence and a README that doubles as the wiring guide. **romainmarcoux/malicious-hash** — Aggregation of lists of malicious hashes of malware that can be integrated into FortiGate firewalls and other products. - Repository: https://github.com/romainmarcoux/malicious-hash - Website: https://www.linkedin.com/in/romainmarcoux/ - Stars: 57 · Forks: 6 - Language: Unknown - License: MIT - Published: 2026-08-24 · Updated: 2026-08-24 · Language: en - Canonical page: https://hysenlabs.com/projects/romainmarcoux-malicious-hash ## Three data files and no code at all The top level of the repository holds five things: LICENSE, README.md, and full-hash-md5-aa.txt, full-hash-sha1-aa.txt, full-hash-sha256-aa.txt. There is no script, no workflow, no generator and no configuration, and GitHub reports no primary language for the project. The transformation that produces these files happens somewhere else. What the repository does hold is a current count table, and the README opens by timestamping it: the table reflects an update of 2026-10-01 04:18 CEST. The counts are 4 096 entries for MD5, 605 for SHA-1 and 87 160 for SHA-256, which is 91 861 values in total. That mix is itself informative: the feed is overwhelmingly SHA-256, with the older algorithms present because malware in the wild still hashes that way. ## The 131,072-entry split exists for the firewall The files are not split by choice, they are split to fit the consumer. Each file holds up to 131,072 entries, a size chosen so the list can be ingested by Fortinet FortiGate and similar equipment, and the README states plainly that each file must be implemented because hashes are not duplicated between files. That last point is the one to get right: configuring only the SHA-256 URL leaves the MD5 and SHA-1 traffic unmatched, because nothing in one file compensates for the absence of another. The three URLs to paste are raw links to the main branch: ``` https://raw.githubusercontent.com/romainmarcoux/malicious-hash/main/full-hash-md5-aa.txt https://raw.githubusercontent.com/romainmarcoux/malicious-hash/main/full-hash-sha1-aa.txt https://raw.githubusercontent.com/romainmarcoux/malicious-hash/main/full-hash-sha256-aa.txt ``` Serving from the default branch means the URL never changes, and the content behind it does. ## Ordering by source count puts the best attested hashes first The lists are not in random or alphabetical order. Hashes are sorted by the number of sources in which they appear, and a hash seen by the most sources therefore sits at the beginning of each file. For a firewall this ordering is a quiet triage signal: the first lines are the values corroborated by several feeds at once, while a value near the end of a file was reported by fewer. It also means the files are not diffable in a meaningful way, since inserting a newly corroborated hash moves everything after it. A reader who wants to know why a value is present has to look at the Sources section rather than at the file itself, because the file carries no annotation, only the hash. ## The FortiGate wiring is a fixed menu path The README doubles as the deployment guide, and the FortiGate procedure is given step by step. You create an external connector under Security Fabric, then External Connectors, then Create New, then Threat Feeds, then Malware Hash, and you paste one of the URLs into the Links section. The second half is the antivirus side: under Security Profiles and AntiVirus, enable Use External Malware Block List, then apply that security profile in a firewall policy that allows HTTP and HTTPS outbound, described as LAN to WAN. Fortinet's own documentation for the malware hash threat feed is linked from the same step, pinned to the 7.0.13 administration guide. The profile has to exist and be applied separately, so a configured connector on its own blocks nothing. ## Four sources, and a fifth that is no longer listed The Sources section is a table with three useful columns: where the data comes from, how far back it goes, and what the feed actually contains. abuse.ch Malware Bazaar is marked 120d and described as sharing malware samples. abuse.ch URLhaus has no stated history and covers payloads downloaded by malicious URLs less than one month ago. The two AlienVault pulses are also unmarked, one covering malware detected less than four months ago and the other the payloads of RagnarLocker Ransomware. The retention windows differ, so the files are not a uniform sample of the same period. The release notes tell a different story: the initial release on 2024-03-02 lists five first sources, and one of them, Banco do Brasil, no longer appears in the table. ## Hourly updates, and a release history that stopped in 2024 Two cadences sit next to each other and they are not the same thing. The data is updated every hour, and the README's first line records when the count table was last regenerated, which was 2026-10-01 04:18 CEST at the time of writing. The last push to the default branch main is dated 2026-09-28. Against that, the Release Notes section contains a single entry, dated 2024-03-02, and the repository publishes no GitHub releases at all. So there is no version to pin, no changelog to diff and no tagged snapshot to roll back to: the raw URLs always serve the current file. A reader who needs to prove what was blocked last Tuesday has to keep their own copy. ## One maintainer, contacted through LinkedIn The project is run by one person, described as a freelance cybersecurity expert working particularly on firewalls, who has maintained it since 2023 to help the community protect itself. False positives, requests to add another source of malicious hashes, consulting enquiries and thanks all go through a LinkedIn profile, which is also the repository's declared homepage. There is no contributing guide, no code of conduct and no issue template in the tree, and since the top level contains no .github directory, the data pipeline is not published either. Two donation links are offered, one hosted on buymeacoffee and one through PayPal. The licence is MIT, which is the only file in the repository other than the README and the three lists. ## Conclusion malicious-hash suits a network team that already runs FortiGate and wants a block list that refreshes itself, and that is willing to accept a single maintainer and a plain text file as the interface. It does not suit anyone who needs provenance per hash, a lookup API, or coverage beyond the four sources named in the README, and the release notes stop at 2024-03-02 even though the data updates every hour. Before wiring it in, note that all three files must be configured since hashes are not duplicated between them, that the ordering puts the most widely sourced values first, and that the repository offers no signed release, only raw URLs on the main branch. ## FAQ ### What is a malicious hash? In this project it is a hash value of malware that was published on a malicious link. The repository aggregates those values and publishes them as three plain text files split by algorithm: MD5, SHA-1 and SHA-256, ordered by how many sources reported each hash. ### How do I check if a file hash is malicious? You compare the value against a list. This project publishes three raw text URLs that can be pasted into a FortiGate malware hash threat feed, and the files are regenerated every hour with the most widely reported hashes first. There is no lookup service or API, the files themselves are the interface. ### Do I need to configure all three malicious-hash files in FortiGate? Yes. Each file holds up to 131,072 entries and hashes are not duplicated between files, so the MD5, SHA-1 and SHA-256 URLs all have to be implemented. After each URL is added under External Connectors, enable Use External Malware Block List in the AntiVirus security profile and apply that profile to an outbound HTTP and HTTPS policy. ### Where does the malicious-hash data come from? Four sources are listed: abuse.ch Malware Bazaar with 120 days of history, abuse.ch URLhaus covering payloads downloaded by malicious URLs in the last month, an AlienVault pulse for malware detected in the last four months, and an AlienVault pulse for RagnarLocker ransomware payloads. The 2024-03-02 initial release also named Banco do Brasil, which the current table does not list. ### Can I pin a version of the malicious-hash lists? Not from the repository. The files are served from raw URLs on the main branch, the repository publishes no GitHub releases, and the release notes contain only the 2024-03-02 initial entry. The README does state that the data is updated every hour. ## Sources - [Official documentation](https://www.linkedin.com/in/romainmarcoux/) - [Official README](https://github.com/romainmarcoux/malicious-hash#readme) - [Project repository](https://github.com/romainmarcoux/malicious-hash) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/romainmarcoux-malicious-hash