phishing-filter (Snort 2)

Von /
von Ming Di Leom Phishing Regex
https://malware-filter.gitlab.io/malware-filter/phishing-filter-snort2.rules Rohliste öffnen
56,4kEinträge
+56,3k -58,9kletzte Änderung
zuletzt aktualisiert
16,3 MBGröße
vor 10 Stundenzuletzt geprüft

Beschreibung

Filterliste aus den Bereichen Phishing. Betreut von Ming Di Leom. Einzelheiten und Aufnahmekriterien stehen auf der Projektseite.

Integration

Add the list to the blocking.denylists section of your config.yml:

blocking:
  denylists:
    default:
      - https://malware-filter.gitlab.io/malware-filter/phishing-filter-snort2.rules
  clientGroupsBlock:
    default:
      - default

Restart Blocky afterwards.

Blocky Dokumentation

Letzte Änderungen

Kürzlich hinzugefügte Einträge

  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"02p4h4.bitrix24.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200000029; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"02twg3.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000030; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"035261.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000031; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"03avtd.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000032; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"03nlvk-3xo43-lut5i-lu9-n95ug.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000033; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0465kk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000034; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"06-0040-0-3986-7356-1324992141.cos.ap-jakarta.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000035; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"06egte3.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000036; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"06t-xiy883-tl87j-xoae-ffyrj.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000037; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0800numbers-uk.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200000038; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0898yczc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000039; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"08yw-wdxv-wbds-ynvme-ojl0fa.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000040; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09-uludag-edu-tr.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000041; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09.2026x02find.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000042; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"090675.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000043; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0987521532.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000054; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0aj-23x92-ovp6-32k4-9fn5c.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000055; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0auth2.1mb.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200000056; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0bsj77.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200000057; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0bzy48-d2wkgv-ol8-2ou6p6.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000058; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0d9a56c5-6a18-4f41-9dcf-1fa0531f9645-00-3s6jlesunorig.riker.replit.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000059; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0dx829.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200000060; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0e37e6ed-727f-469f-8fd4-4e262b9cdc59.s3.us-west-2.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000061; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0e7h4hr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000062; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0e87599127.nxcli.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000063; rev:1;)

Kürzlich entfernte Einträge

  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"02twg3.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000029; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"035261.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000030; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"03avtd.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000031; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"03nlvk-3xo43-lut5i-lu9-n95ug.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000032; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0465kk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000033; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"06-0040-0-3986-7356-1324992141.cos.ap-jakarta.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000034; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"06egte3.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000035; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"06t-xiy883-tl87j-xoae-ffyrj.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000036; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0800numbers-uk.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200000037; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0898yczc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000038; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"08yw-wdxv-wbds-ynvme-ojl0fa.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000039; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09-uludag-edu-tr.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000040; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09.2026x02find.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000041; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"090675.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000042; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0918784avispdf.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000043; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0auth2.1mb.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200000054; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0bsj77.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200000055; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0c3ba2.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200000056; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0d9a56c5-6a18-4f41-9dcf-1fa0531f9645-00-3s6jlesunorig.riker.replit.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000057; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0dx829.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200000058; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0e37e6ed-727f-469f-8fd4-4e262b9cdc59.s3.us-west-2.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000059; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0e7h4hr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000060; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0e87599127.nxcli.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000061; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0ej37yhe.cfd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000062; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0er-2qet17-3lr-lfm-4hjt-uym9.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000063; rev:1;)
Nach oben scrollen