phishing-filter (Snort 3)

Von /
von Ming Di Leom Phishing Regex
https://malware-filter.gitlab.io/malware-filter/phishing-filter-snort3.rules Rohliste öffnen
55,5kEinträge
+55,5k -55,8kletzte Änderung
zuletzt aktualisiert
12,8 MBGröße
vor 24 Stundenzuletzt geprüft

Beschreibung

Filterliste aus den Bereichen Phishing. Betreut von Ming Di Leom. Einzelheiten und Aufnahmekriterien stehen auf der Projektseite.

Integration

Add the list to the blocking.denylists section of your config.yml:

blocking:
  denylists:
    default:
      - https://malware-filter.gitlab.io/malware-filter/phishing-filter-snort3.rules
  clientGroupsBlock:
    default:
      - default

Restart Blocky afterwards.

Blocky Dokumentation

Letzte Änderungen

Kürzlich hinzugefügte Einträge

  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0000000000000190000010111.weebly.com",nocase; classtype:attempted-recon; sid:200000006; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"000039a9-398f-7000-a805-921aa822efc.vercel.app",nocase; classtype:attempted-recon; sid:200000007; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0002985647.weebly.com",nocase; classtype:attempted-recon; sid:200000008; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"001dda.top",nocase; classtype:attempted-recon; sid:200000009; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"001zimbra.weebly.com",nocase; classtype:attempted-recon; sid:200000010; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"008963466.weebly.com",nocase; classtype:attempted-recon; sid:200000011; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"009-8777.weebly.com",nocase; classtype:attempted-recon; sid:200000012; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"009090334mn.vercel.app",nocase; classtype:attempted-recon; sid:200000013; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0098-fr.weebly.com",nocase; classtype:attempted-recon; sid:200000014; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0099997.weebly.com",nocase; classtype:attempted-recon; sid:200000015; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"00loo0j.weebly.com",nocase; classtype:attempted-recon; sid:200000016; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"00nvk529ieyf-pages-dev.translate.goog",nocase; classtype:attempted-recon; sid:200000017; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"00o0o00o0o.skapi.com",nocase; classtype:attempted-recon; sid:200000018; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"00rorrv8f-rue3wn.weebly.com",nocase; classtype:attempted-recon; sid:200000019; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"01092correo.weebly.com",nocase; classtype:attempted-recon; sid:200000020; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0142plus.weebly.com",nocase; classtype:attempted-recon; sid:200000021; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"01c2e787-6c49-4365-8be5-e5d1c9e19ed3-00-2y5i0zdquflg3.worf.replit.dev",nocase; classtype:attempted-recon; sid:200000022; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"023kew6.top",nocase; classtype:attempted-recon; sid:200000023; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"023rs4ffef.weebly.com",nocase; classtype:attempted-recon; sid:200000024; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02d772vb82.webcindario.com",nocase; classtype:attempted-recon; sid:200000025; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02ip.ru",nocase; classtype:attempted-recon; sid:200000026; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02jwye.garden",nocase; classtype:attempted-recon; sid:200000027; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02p4h4.bitrix24.site",nocase; classtype:attempted-recon; sid:200000028; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02twg3.top",nocase; classtype:attempted-recon; sid:200000029; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"035261.weebly.com",nocase; classtype:attempted-recon; sid:200000030; rev:1;)

Kürzlich entfernte Einträge

  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0000--carmennidia20.replit.app",nocase; classtype:attempted-recon; sid:200000006; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0000000000000190000010111.weebly.com",nocase; classtype:attempted-recon; sid:200000007; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"000039a9-398f-7000-a805-921aa822efc.vercel.app",nocase; classtype:attempted-recon; sid:200000008; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0002985647.weebly.com",nocase; classtype:attempted-recon; sid:200000009; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"001dda.top",nocase; classtype:attempted-recon; sid:200000010; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"001zimbra.weebly.com",nocase; classtype:attempted-recon; sid:200000011; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"008963466.weebly.com",nocase; classtype:attempted-recon; sid:200000012; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"009-8777.weebly.com",nocase; classtype:attempted-recon; sid:200000013; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"009090334mn.vercel.app",nocase; classtype:attempted-recon; sid:200000014; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0098-fr.weebly.com",nocase; classtype:attempted-recon; sid:200000015; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0099997.weebly.com",nocase; classtype:attempted-recon; sid:200000016; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"00loo0j.weebly.com",nocase; classtype:attempted-recon; sid:200000017; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"00nvk529ieyf-pages-dev.translate.goog",nocase; classtype:attempted-recon; sid:200000018; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"00o0o00o0o.skapi.com",nocase; classtype:attempted-recon; sid:200000019; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"00rorrv8f-rue3wn.weebly.com",nocase; classtype:attempted-recon; sid:200000020; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"01092correo.weebly.com",nocase; classtype:attempted-recon; sid:200000021; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0142plus.weebly.com",nocase; classtype:attempted-recon; sid:200000022; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"01c2e787-6c49-4365-8be5-e5d1c9e19ed3-00-2y5i0zdquflg3.worf.replit.dev",nocase; classtype:attempted-recon; sid:200000023; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"023kew6.top",nocase; classtype:attempted-recon; sid:200000024; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"023rs4ffef.weebly.com",nocase; classtype:attempted-recon; sid:200000025; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02d772vb82.webcindario.com",nocase; classtype:attempted-recon; sid:200000026; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02ip.ru",nocase; classtype:attempted-recon; sid:200000027; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02jwye.garden",nocase; classtype:attempted-recon; sid:200000028; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02p4h4.bitrix24.site",nocase; classtype:attempted-recon; sid:200000029; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02twg3.top",nocase; classtype:attempted-recon; sid:200000030; rev:1;)
Nach oben scrollen