GitHub RadarBlue team tool
Advanced Phishing Protection: Suricata rulesets open and free Primary language: Python. 38 stars.
Project links:Open GitHub projectBack to radar
Image: GitHub commit activity Image: GitHub commit activity
**[DONATE] · [DASHBOARD VECTORS](https://julioliraup.github.io/AT) · [CONTRIBUTING](./CONTRIBUTING.md) · [SUBMIT A VECTOR](/julioliraup/Antiphishing/issues/new?q=state%3Aopen%20label%3A%22Phishing%20Vector%22) · [REST API CTI](https://github.com/julioliraup/AT/wiki/REST-API-USE) · [WIKI**](/julioliraup/Antiphishing/wiki)
Predictive Phishing Intelligence for Suricata — Preemptive Defense from Day Zero
Antiphishing is an open-source (GPLv3) Cyber Threat Intelligence (CTI) infrastructure and Suricata ruleset designed to identify and disrupt phishing infrastructure as early as possible at the network layer.
The project combines curated phishing indicators, automated threat intelligence processing, and analysis of Newly Registered Domains (NRDs) to identify suspicious emerging infrastructure before it becomes widely recognized by conventional threat feeds.
Antiphishing is designed to transform emerging threat intelligence into deployable Suricata detection and prevention rules.
---
Modern phishing infrastructure can be created, weaponized, and abandoned within a short period of time.
Traditional blocklists are valuable, but they generally identify infrastructure after indicators have already been observed, reported, or validated.
Antiphishing explores a complementary approach: preemptive threat intelligence.
The NRD pipeline monitors newly registered domains with observed DNS activity and analyzes candidate domains using multiple heuristics, including:
The pipeline analyzes more than 1.5 million candidate domain combinations and produces a set of domains considered suspicious enough for further security action.
The objective is not to claim that every newly registered domain is malicious. Instead, the goal is to identify potential phishing infrastructure at an early stage, before it necessarily appears in conventional malicious-domain feeds.
This creates a complementary detection layer between raw infrastructure registration and confirmed malicious intelligence.
The term Day Zero in Antiphishing refers to the project's goal of reducing the time between the emergence of suspicious infrastructure and defensive action.
It does not mean that Antiphishing can detect every zero-day attack, vulnerability, or previously unknown malware family.
The focus is narrower and practical:
Identify suspicious phishing infrastructure as early as possible and make that intelligence actionable at the network layer.
---
Predictive intelligence requires a different confidence model from traditional validated IOC feeds.
Domains generated by the NRD analysis pipeline are candidate indicators produced through automated heuristics. They should therefore be treated as highly suspicious infrastructure, rather than automatically interpreted as manually validated malicious IOCs.
Because the NRD pipeline prioritizes early detection, false positives are possible.
Organizations deploying predictive indicators should consider appropriate:
The NRD-derived intelligence is particularly suited to environments where early blocking of suspicious infrastructure is preferable to waiting for a domain to become a confirmed malicious IOC.
This is a deliberate trade-off:
Earlier intelligence can provide earlier protection, but earlier intelligence also carries greater uncertainty.
---
Antiphishing is more than a static phishing blocklist.
The project combines multiple sources and processing stages:
External Threat Feeds
│
├── Phishing indicators
│
└── Infrastructure indicators
│
▼
┌───────────────────┐
│ Intelligence │
│ Processing │
└───────────────────┘
│
├── Domain analysis
├── IP analysis
└── URL processing
│
▼
Newly Registered Domains
│
▼
Candidate Generation
│
├── Typosquatting
├── Homoglyphs
├── Keywords
└── Brand impersonation
│
▼
Suspicious Infrastructure
│
▼
Suricata Detection
│
▼
IDS / IPS EnforcementThe project also relies on external free software, open-source libraries, public intelligence sources, and community APIs.
Antiphishing's role is to combine these components into an automated intelligence and detection pipeline.
---
The main Suricata ruleset (antiphishing.rules) provides multiple detection layers.
Important: Whether a matching rule generates an alert or actively blocks traffic depends on how Suricata is deployed and configured, particularly whether it is operating in IDS or IPS mode.
Detection of suspicious domains during DNS inspection using:
dns.queryThe native Suricata dataset contains the domain intelligence used by the DNS signature.
Detection through the TLS Server Name Indication (SNI):
tls.sniThis allows domain-based detection without decrypting HTTPS traffic.
Inspection of HTTP traffic and phishing URLs using application-layer signatures.
HTTP detection can provide more specific visibility into the requested resource when the traffic is available for inspection.
Detection of connections to known phishing infrastructure using destination IPv4 intelligence.
The main ruleset uses Suricata's dataset mechanism for this intelligence.
---
The main Antiphishing ruleset uses native Suricata external datasets.
phishing.lstDomain intelligence used by the DNS and TLS dataset signatures.
The domain dataset is maintained separately from the Suricata signature file because it contains dataset values rather than Suricata signatures.
phishing_ips.lstIPv4 indicators used by the destination-IP dataset signature.
nrd_suspicious_domains.txtDomains generated by the NRD analysis pipeline and classified as suspicious candidates.
Important: NRD-derived domains are predictive intelligence and should not automatically be interpreted as confirmed malicious indicators.
---
Antiphishing is integrated with the OPNsense IDS/IPS ecosystem through:
os-intrusion-detection-content-at-antiphishing
The OPNsense integration is currently not equivalent to the full native Antiphishing ruleset.
The existing OPNsense integration reliably provides the HTTP signatures.
The external DNS, TLS, and IPv4 datasets require additional handling because the OPNsense IDS content framework does not currently provide a uniform mechanism for distributing and loading external Suricata dataset files.
The main Antiphishing ruleset continues to use Suricata's native dataset implementation and is not changed to accommodate this OPNsense limitation.
An OPNsense-specific ruleset is being investigated and tested separately.
OPNsense users should therefore verify the capabilities of the specific distributed ruleset before assuming that all Antiphishing detection layers are active.
The project aims to provide a stable OPNsense integration rather than shipping a configuration that can cause Suricata to fail during startup or reload.
---
antiphishing.rules
https://github.com/julioliraup/Antiphishing/raw/refs/heads/main/antiphishing.rules
The main ruleset uses the external datasets described above.
antiphishing-opnsense.rules
https://github.com/julioliraup/Antiphishing/raw/refs/heads/main/antiphishing-opnsense.rules
This file is an OPNsense-specific compatibility variant and may not provide the same detection coverage as the main ruleset.
phishing.lst
https://github.com/julioliraup/Antiphishing/raw/refs/heads/main/phishing.lst
Base64-encoded Suricata dataset.
phishing_ips.lst
https://github.com/julioliraup/Antiphishing/raw/refs/heads/main/phishing_ips.lst
Plain-text IPv4 dataset.
nrd_suspicious_domains.txt
https://github.com/julioliraup/Antiphishing/raw/refs/heads/main/nrd_suspicious_domains.txt
NRD-derived suspicious-domain intelligence.
---
Antiphishing is designed to integrate with Suricata and suricata-update.
The preferred installation method depends on the target platform.
See the installation and configuration guide:
https://github.com/julioliraup/Antiphishing/wiki/Configuration-Ruleset-on-GNU-Linux
<a href="https://github.com/julioliraup/Antiphishing/wiki/Configuration-Ruleset-on-GNU-Linux"> <img height="100" alt="Configuration-Ruleset-on-GNU-Linux" src="https://github.com/user-attachments/assets/859b9e29-a650-48b2-968c-628e8c345b5b" /> <img height="100" alt="Configuration-Ruleset-on-cearos" src="https://github.com/user-attachments/assets/083098a4-64b9-4c29-994d-75dcd61fa695" /> </a>
https://github.com/julioliraup/Antiphishing/wiki/Configuration-Ruleset-on-pfSense
<a href="https://github.com/julioliraup/Antiphishing/wiki/Configuration-Ruleset-on-pfSense"> <img height="100" alt="Configuration-Ruleset-on-pfSense" src="https://github.com/user-attachments/assets/55fcc78d-af99-4e7f-9022-75b644f3c497" /> </a>
https://github.com/julioliraup/Antiphishing/wiki/Configuration:-Antiphishing-Ruleset-on-IDSTower
<a href="https://github.com/julioliraup/Antiphishing/wiki/Configuration:-Antiphishing-Ruleset-on-IDSTower"> <img height="90" alt="Configuration: Antiphishing Ruleset on IDSTower" src="https://github.com/user-attachments/assets/1044e7a6-13fa-48f4-bbfc-1a7662f5afd0" /> </a>
The Antiphishing ruleset is available through the OPNsense IDS/IPS content ecosystem.
<a href="https://github.com/julioliraup/Antiphishing/wiki/Quick-Guide:-Installing-Antiphishing-on-OPNsense-(-=-26.7.2)"> <img height="90" alt="OPNsense Antiphishing ruleset on Suricata" src="https://github.com/user-attachments/assets/551b04de-b34c-4856-85b7-1928639bc6ec" /> </a>
See the OPNsense documentation and the project wiki for the current integration status and installation procedure.
<img height="100" alt="IPFire julioliraup/antiphishing ruleset on intrusion prevention" src="https://github.com/user-attachments/assets/a8f0e322-7d18-4219-b5fb-32188e2207a3"/>
---
The Antiphishing intelligence pipeline is updated dynamically approximately every 6 hours to track emerging phishing infrastructure.
The update pipeline processes intelligence from multiple sources and regenerates the Suricata rules and datasets.
The project is designed for integration with: