GitHub RadarBlue team tool
Suricata rulesets to protect against phishing attack. Primary language: Python. 13 stars.
Project links:Open GitHub projectBack to radar
Image: Antiphishing logo Image: GitHub commit activity Image: GitHub commit activity
[DONATE - DASHBOARD VECTORS - CONTRIBUTING - SUBMIT A VECTOR - REST API CTI - WIKI ]
Protect against phishing attacks
This rule is built using malicious URLs and domains involved in phishing attacks. We utilize some community APIs to construct these rules, and with them, we create TLS, DNS, and HTTP rules.
Our sources:
Contribution: CONTRIBUTING.md
<a href="https://github.com/julioliraup/Antiphishing/wiki/Configuration-Ruleset-on-GNU-Linux"> <img height="100" alt="Configuration-Ruleset-on-GNU-Linux" src="https://github.com/user-attachments/assets/859b9e29-a650-48b2-968c-628e8c345b5b" /> <img height="100" alt="Configuration-Ruleset-on-cearos" src="https://github.com/user-attachments/assets/083098a4-64b9-4c29-994d-75dcd61fa695" /> </a>
<a href="https://github.com/julioliraup/Antiphishing/wiki/Configuration-Ruleset-on-pfSense"> <img height="100" alt="Configuration-Ruleset-on-pfSense" src="https://github.com/user-attachments/assets/55fcc78d-af99-4e7f-9022-75b644f3c497" /> </a>
<a href="https://github.com/julioliraup/Antiphishing/wiki/Configuration:-Antiphishing-Ruleset-on-IDSTower"> <img height="90" alt="Configuration: Antiphishing Ruleset on IDSTower" src="https://github.com/user-attachments/assets/1044e7a6-13fa-48f4-bbfc-1a7662f5afd0" /> </a>
The ruleset is the antiphishing.rules file, which contains two rules (TLS, DNS) that depend on a phishing.lst list. Finally, there is another file named antiphishing.rules.md5 for integrity verification. We provide a compressed file containing these mentioned files, which are constantly updated without changing the URL (tar.gz):
https://github.com/julioliraup/Antiphishing/raw/refs/heads/main/antiphishing.tar.gzDot rules file:
https://github.com/julioliraup/Antiphishing/raw/refs/heads/main/antiphishing.rules<img height="100" alt="IPFire julioliraup/antiphishing ruleset on intrusion prevention" src="https://github.com/user-attachments/assets/a8f0e322-7d18-4219-b5fb-32188e2207a3"/> <img height="100" alt="OPNsense julioliraup/antiphishing ruleset on Suricata" src="https://github.com/user-attachments/assets/551b04de-b34c-4856-85b7-1928639bc6ec" />
Our ruleset is updated dynamically every ~6 hours to track emerging phishing vectors.
6000000 - 6100000 (Carefully assigned to prevent conflicts with other rulesets) .suricata-update.---
This project is open-source and free for both personal and commercial use. To maintain high-availability infrastructure, automated collection pipelines, and our Threat Intelligence Lookup Portal (/AT), we rely on community and corporate funding.
You can support the project instantly via PIX:
08650081401For recurring sponsorship, priority support, or international donations, please check our FUNDING.md or use the Sponsor button at the top of this repository.
---
If you encounter any false positives, have suggestions, or want to discuss corporate partnerships: