diff --git a/README.md b/README.md
index 164e0b16..7c205104 100644
--- a/README.md
+++ b/README.md
@@ -26,7 +26,7 @@ Use [urlhaus-filter](https://gitlab.com/curben/urlhaus-filter) to block malware
 
 Import the following URL into uBO to subscribe:
 
-- https://curben.gitlab.io/phishing-filter-mirror/phishing-filter.txt
+- https://curben.gitlab.io/malware-filter/phishing-filter.txt
 
 <details>
 <summary>Mirrors</summary>
@@ -46,7 +46,7 @@ Import the following URL into uBO to subscribe:
 
 Import the following URL into AdGuard browser extension to subscribe:
 
-- https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-ag.txt
+- https://curben.gitlab.io/malware-filter/phishing-filter-ag.txt
 
 <details>
 <summary>Mirrors</summary>
@@ -66,7 +66,7 @@ _Requires Vivaldi Desktop/Android 3.3+, blocking level must be at least "Block T
 
 Import the following URL into Vivaldi's **Tracker Blocking Sources** to subscribe:
 
-- https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-vivaldi.txt
+- https://curben.gitlab.io/malware-filter/phishing-filter-vivaldi.txt
 
 <details>
 <summary>Mirrors</summary>
@@ -84,7 +84,7 @@ Import the following URL into Vivaldi's **Tracker Blocking Sources** to subscrib
 
 This blocklist includes domains and IP addresses.
 
-- https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-domains.txt
+- https://curben.gitlab.io/malware-filter/phishing-filter-domains.txt
 
 <details>
 <summary>Mirrors</summary>
@@ -102,7 +102,7 @@ This blocklist includes domains and IP addresses.
 
 This AdGuard Home-compatible blocklist includes domains and IP addresses.
 
-- https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-agh.txt
+- https://curben.gitlab.io/malware-filter/phishing-filter-agh.txt
 
 <details>
 <summary>Mirrors</summary>
@@ -120,7 +120,7 @@ This AdGuard Home-compatible blocklist includes domains and IP addresses.
 
 This blocklist includes domains only.
 
-- https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-hosts.txt
+- https://curben.gitlab.io/malware-filter/phishing-filter-hosts.txt
 
 <details>
 <summary>Mirrors</summary>
@@ -145,7 +145,7 @@ This blocklist includes domains only.
 mkdir -p /usr/local/etc/dnsmasq/
 
 # Create a new cron job for daily update
-printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-dnsmasq.conf" -o "/usr/local/etc/dnsmasq/phishing-filter-dnsmasq.conf"\n' > /etc/cron.daily/phishing-filter
+printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/phishing-filter-dnsmasq.conf" -o "/usr/local/etc/dnsmasq/phishing-filter-dnsmasq.conf"\n' > /etc/cron.daily/phishing-filter
 
 # cron job requires execution permission
 chmod 755 /etc/cron.daily/phishing-filter
@@ -154,7 +154,7 @@ chmod 755 /etc/cron.daily/phishing-filter
 printf "\nconf-file=/usr/local/etc/dnsmasq/phishing-filter-dnsmasq.conf\n" >> /etc/dnsmasq.conf
 ```
 
-- https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-dnsmasq.conf
+- https://curben.gitlab.io/malware-filter/phishing-filter-dnsmasq.conf
 
 <details>
 <summary>Mirrors</summary>
@@ -179,7 +179,7 @@ This blocklist includes domains only.
 mkdir -p /usr/local/etc/bind/
 
 # Create a new cron job for daily update
-printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-bind.conf" -o "/usr/local/etc/bind/phishing-filter-bind.conf"\n' > /etc/cron.daily/phishing-filter
+printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/phishing-filter-bind.conf" -o "/usr/local/etc/bind/phishing-filter-bind.conf"\n' > /etc/cron.daily/phishing-filter
 
 # cron job requires execution permission
 chmod 755 /etc/cron.daily/phishing-filter
@@ -206,7 +206,7 @@ $TTL    86400   ; one day
 
 Zone file is derived from [here](https://github.com/tomzuu/blacklist-named/blob/master/null.zone.file).
 
-- https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-bind.conf
+- https://curben.gitlab.io/malware-filter/phishing-filter-bind.conf
 
 <details>
 <summary>Mirrors</summary>
@@ -231,7 +231,7 @@ This blocklist includes domains only.
 mkdir -p /usr/local/etc/unbound/
 
 # Create a new cron job for daily update
-printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-unbound.conf" -o "/usr/local/etc/unbound/phishing-filter-unbound.conf"\n' > /etc/cron.daily/phishing-filter
+printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/phishing-filter-unbound.conf" -o "/usr/local/etc/unbound/phishing-filter-unbound.conf"\n' > /etc/cron.daily/phishing-filter
 
 # cron job requires execution permission
 chmod 755 /etc/cron.daily/phishing-filter
@@ -240,7 +240,7 @@ chmod 755 /etc/cron.daily/phishing-filter
 printf '\n  include: "/usr/local/etc/unbound/phishing-filter-unbound.conf"\n' >> /etc/unbound/unbound.conf
 ```
 
-- https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-unbound.conf
+- https://curben.gitlab.io/malware-filter/phishing-filter-unbound.conf
 
 <details>
 <summary>Mirrors</summary>
@@ -258,7 +258,7 @@ printf '\n  include: "/usr/local/etc/unbound/phishing-filter-unbound.conf"\n' >>
 
 This blocklist includes domains only.
 
-- https://curben.gitlab.io/phishing-filter-mirror/phishing-filter.tpl
+- https://curben.gitlab.io/malware-filter/phishing-filter.tpl
 
 <details>
 <summary>Mirrors</summary>
@@ -280,10 +280,10 @@ This ruleset includes online URLs only. Not compatible with [Snort3](#snort3).
 
 ```
 # Download ruleset
-curl -L "https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-snort2.rules" -o "/etc/snort/rules/phishing-filter-snort2.rules"
+curl -L "https://curben.gitlab.io/malware-filter/phishing-filter-snort2.rules" -o "/etc/snort/rules/phishing-filter-snort2.rules"
 
 # Create a new cron job for daily update
-printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-snort2.rules" -o "/etc/snort/rules/phishing-filter-snort2.rules"\n' > /etc/cron.daily/phishing-filter
+printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/phishing-filter-snort2.rules" -o "/etc/snort/rules/phishing-filter-snort2.rules"\n' > /etc/cron.daily/phishing-filter
 
 # cron job requires execution permission
 chmod 755 /etc/cron.daily/phishing-filter
@@ -292,7 +292,7 @@ chmod 755 /etc/cron.daily/phishing-filter
 printf "\ninclude \$RULE_PATH/phishing-filter-snort2.rules\n" >> /etc/snort/snort.conf
 ```
 
-- https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-snort2.rules
+- https://curben.gitlab.io/malware-filter/phishing-filter-snort2.rules
 
 <details>
 <summary>Mirrors</summary>
@@ -314,10 +314,10 @@ This ruleset includes online URLs only. Not compatible with [Snort2](#snort2).
 
 ```
 # Download ruleset
-curl -L "https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-snort3.rules" -o "/etc/snort/rules/phishing-filter-snort3.rules"
+curl -L "https://curben.gitlab.io/malware-filter/phishing-filter-snort3.rules" -o "/etc/snort/rules/phishing-filter-snort3.rules"
 
 # Create a new cron job for daily update
-printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-snort3.rules" -o "/etc/snort/rules/phishing-filter-snort3.rules"\n' > /etc/cron.daily/phishing-filter
+printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/phishing-filter-snort3.rules" -o "/etc/snort/rules/phishing-filter-snort3.rules"\n' > /etc/cron.daily/phishing-filter
 
 # cron job requires execution permission
 chmod 755 /etc/cron.daily/phishing-filter
@@ -334,7 +334,7 @@ ips =
 }
 ```
 
-- https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-snort3.rules
+- https://curben.gitlab.io/malware-filter/phishing-filter-snort3.rules
 
 <details>
 <summary>Mirrors</summary>
@@ -356,10 +356,10 @@ This ruleset includes online URLs only.
 
 ```
 # Download ruleset
-curl -L "https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-suricata.rules" -o "/etc/suricata/rules/phishing-filter-suricata.rules"
+curl -L "https://curben.gitlab.io/malware-filter/phishing-filter-suricata.rules" -o "/etc/suricata/rules/phishing-filter-suricata.rules"
 
 # Create a new cron job for daily update
-printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-suricata.rules" -o "/etc/suricata/rules/phishing-filter-suricata.rules"\n' > /etc/cron.daily/phishing-filter
+printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/phishing-filter-suricata.rules" -o "/etc/suricata/rules/phishing-filter-suricata.rules"\n' > /etc/cron.daily/phishing-filter
 
 # cron job requires execution permission
 chmod 755 /etc/cron.daily/phishing-filter
@@ -374,7 +374,7 @@ rule-files:
 +  - phishing-filter-suricata.rules
 ```
 
-- https://curben.gitlab.io/phishing-filter-mirror/phishing-filter-suricata.rules
+- https://curben.gitlab.io/malware-filter/phishing-filter-suricata.rules
 
 <details>
 <summary>Mirrors</summary>