phishing-filter (Suricata)

Von /
von Ming Di Leom Phishing Regex
https://malware-filter.gitlab.io/malware-filter/phishing-filter-suricata.rules Rohliste öffnen
55,5kEinträge
+55,5k -55,8kletzte Änderung
zuletzt aktualisiert
15,1 MBGröße
vor 5 Stundenzuletzt geprüft

Beschreibung

Filterliste aus den Bereichen Phishing. Betreut von Ming Di Leom. Einzelheiten und Aufnahmekriterien stehen auf der Projektseite.

Integration

Add the list to the blocking.denylists section of your config.yml:

blocking:
  denylists:
    default:
      - https://malware-filter.gitlab.io/malware-filter/phishing-filter-suricata.rules
  clientGroupsBlock:
    default:
      - default

Restart Blocky afterwards.

Blocky Dokumentation

Letzte Änderungen

Kürzlich hinzugefügte Einträge

  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0000000000000190000010111.weebly.com"; classtype:attempted-recon; sid:200000006 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"000039a9-398f-7000-a805-921aa822efc.vercel.app"; classtype:attempted-recon; sid:200000007 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0002985647.weebly.com"; classtype:attempted-recon; sid:200000008 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"001dda.top"; classtype:attempted-recon; sid:200000009 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"001zimbra.weebly.com"; classtype:attempted-recon; sid:200000010 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"008963466.weebly.com"; classtype:attempted-recon; sid:200000011 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"009-8777.weebly.com"; classtype:attempted-recon; sid:200000012 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"009090334mn.vercel.app"; classtype:attempted-recon; sid:200000013 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0098-fr.weebly.com"; classtype:attempted-recon; sid:200000014 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0099997.weebly.com"; classtype:attempted-recon; sid:200000015 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"00loo0j.weebly.com"; classtype:attempted-recon; sid:200000016 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"00nvk529ieyf-pages-dev.translate.goog"; classtype:attempted-recon; sid:200000017 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"00o0o00o0o.skapi.com"; classtype:attempted-recon; sid:200000018 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"00rorrv8f-rue3wn.weebly.com"; classtype:attempted-recon; sid:200000019 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"01092correo.weebly.com"; classtype:attempted-recon; sid:200000020 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0142plus.weebly.com"; classtype:attempted-recon; sid:200000021 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"01c2e787-6c49-4365-8be5-e5d1c9e19ed3-00-2y5i0zdquflg3.worf.replit.dev"; classtype:attempted-recon; sid:200000022 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"023kew6.top"; classtype:attempted-recon; sid:200000023 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"023rs4ffef.weebly.com"; classtype:attempted-recon; sid:200000024 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"02d772vb82.webcindario.com"; classtype:attempted-recon; sid:200000025 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"02ip.ru"; classtype:attempted-recon; sid:200000026 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"02jwye.garden"; classtype:attempted-recon; sid:200000027 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"02p4h4.bitrix24.site"; classtype:attempted-recon; sid:200000028 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"02twg3.top"; classtype:attempted-recon; sid:200000029 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"035261.weebly.com"; classtype:attempted-recon; sid:200000030 rev:1;)

Kürzlich entfernte Einträge

  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0000--carmennidia20.replit.app"; classtype:attempted-recon; sid:200000006 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0000000000000190000010111.weebly.com"; classtype:attempted-recon; sid:200000007 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"000039a9-398f-7000-a805-921aa822efc.vercel.app"; classtype:attempted-recon; sid:200000008 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0002985647.weebly.com"; classtype:attempted-recon; sid:200000009 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"001dda.top"; classtype:attempted-recon; sid:200000010 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"001zimbra.weebly.com"; classtype:attempted-recon; sid:200000011 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"008963466.weebly.com"; classtype:attempted-recon; sid:200000012 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"009-8777.weebly.com"; classtype:attempted-recon; sid:200000013 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"009090334mn.vercel.app"; classtype:attempted-recon; sid:200000014 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0098-fr.weebly.com"; classtype:attempted-recon; sid:200000015 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0099997.weebly.com"; classtype:attempted-recon; sid:200000016 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"00loo0j.weebly.com"; classtype:attempted-recon; sid:200000017 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"00nvk529ieyf-pages-dev.translate.goog"; classtype:attempted-recon; sid:200000018 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"00o0o00o0o.skapi.com"; classtype:attempted-recon; sid:200000019 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"00rorrv8f-rue3wn.weebly.com"; classtype:attempted-recon; sid:200000020 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"01092correo.weebly.com"; classtype:attempted-recon; sid:200000021 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0142plus.weebly.com"; classtype:attempted-recon; sid:200000022 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"01c2e787-6c49-4365-8be5-e5d1c9e19ed3-00-2y5i0zdquflg3.worf.replit.dev"; classtype:attempted-recon; sid:200000023 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"023kew6.top"; classtype:attempted-recon; sid:200000024 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"023rs4ffef.weebly.com"; classtype:attempted-recon; sid:200000025 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"02d772vb82.webcindario.com"; classtype:attempted-recon; sid:200000026 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"02ip.ru"; classtype:attempted-recon; sid:200000027 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"02jwye.garden"; classtype:attempted-recon; sid:200000028 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"02p4h4.bitrix24.site"; classtype:attempted-recon; sid:200000029 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"02twg3.top"; classtype:attempted-recon; sid:200000030 rev:1;)
Nach oben scrollen