Proton's blog posts   don't state details on the filter lists being used, only that it's a "massive database of sites known to host malware, spyware, or any other malicious software."
But it looks like they mentioned on Reddit , "We have both public and proprietary lists that we maintain." 😕
And it looks like Proton decided NetShield is only a paid feature. Free users don't get to block malware lol
Personal instance of nitrohorse (nitrohorse.com).