urlhaus-filter (Snort 2)

Von /
von Ming Di Leom Malware Regex
https://malware-filter.gitlab.io/malware-filter/urlhaus-filter-snort2-online.rules Rohliste öffnen
24,2kEinträge
+24,2k -24,0kletzte Änderung
zuletzt aktualisiert
8,6 MBGröße
vor 19 Stundenzuletzt geprüft

Beschreibung

Filterliste aus den Bereichen Malware. Betreut von Ming Di Leom. Einzelheiten und Aufnahmekriterien stehen auf der Projektseite.

Integration

Add the list to the blocking.denylists section of your config.yml:

blocking:
  denylists:
    default:
      - https://malware-filter.gitlab.io/malware-filter/urlhaus-filter-snort2-online.rules
  clientGroupsBlock:
    default:
      - default

Restart Blocky afterwards.

Blocky Dokumentation

Letzte Änderungen

Kürzlich hinzugefügte Einträge

  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.101.85.165"; content:"Host"; http_header; classtype:trojan-activity; sid:100000023; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.101.85.173"; content:"Host"; http_header; classtype:trojan-activity; sid:100000024; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.106.250.161"; content:"Host"; http_header; classtype:trojan-activity; sid:100000025; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.116.190.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100000026; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.125.163.10"; content:"Host"; http_header; classtype:trojan-activity; sid:100000027; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.125.174.116"; content:"Host"; http_header; classtype:trojan-activity; sid:100000028; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.126.201.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100000029; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.140.87.105"; content:"Host"; http_header; classtype:trojan-activity; sid:100000030; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.152.141.10"; content:"Host"; http_header; classtype:trojan-activity; sid:100000031; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.159.152.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100000032; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.163.119.220"; content:"Host"; http_header; classtype:trojan-activity; sid:100000033; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.164.117.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100000034; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.164.200.170"; content:"Host"; http_header; classtype:trojan-activity; sid:100000035; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.168.67.55"; content:"Host"; http_header; classtype:trojan-activity; sid:100000036; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.171.168.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100000037; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.172.186.147"; content:"Host"; http_header; classtype:trojan-activity; sid:100000038; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.206.139.61"; content:"Host"; http_header; classtype:trojan-activity; sid:100000039; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.209.67.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100000040; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.210.144.11"; content:"Host"; http_header; classtype:trojan-activity; sid:100000041; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.217.215.238"; content:"Host"; http_header; classtype:trojan-activity; sid:100000042; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.226.124.232"; content:"Host"; http_header; classtype:trojan-activity; sid:100000043; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.226.249.227"; content:"Host"; http_header; classtype:trojan-activity; sid:100000044; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.227.118.45"; content:"Host"; http_header; classtype:trojan-activity; sid:100000045; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.231.13.161"; content:"Host"; http_header; classtype:trojan-activity; sid:100000046; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.240.211.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100000047; rev:1;)

Kürzlich entfernte Einträge

  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.106.250.161"; content:"Host"; http_header; classtype:trojan-activity; sid:100000023; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.116.190.93"; content:"Host"; http_header; classtype:trojan-activity; sid:100000024; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.125.163.10"; content:"Host"; http_header; classtype:trojan-activity; sid:100000025; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.125.174.116"; content:"Host"; http_header; classtype:trojan-activity; sid:100000026; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.126.201.130"; content:"Host"; http_header; classtype:trojan-activity; sid:100000027; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.159.152.118"; content:"Host"; http_header; classtype:trojan-activity; sid:100000028; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.163.119.220"; content:"Host"; http_header; classtype:trojan-activity; sid:100000029; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.164.117.74"; content:"Host"; http_header; classtype:trojan-activity; sid:100000030; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.164.200.170"; content:"Host"; http_header; classtype:trojan-activity; sid:100000031; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.168.67.55"; content:"Host"; http_header; classtype:trojan-activity; sid:100000032; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.206.139.61"; content:"Host"; http_header; classtype:trojan-activity; sid:100000033; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.209.67.34"; content:"Host"; http_header; classtype:trojan-activity; sid:100000034; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.217.215.238"; content:"Host"; http_header; classtype:trojan-activity; sid:100000035; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.226.124.232"; content:"Host"; http_header; classtype:trojan-activity; sid:100000036; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.226.249.227"; content:"Host"; http_header; classtype:trojan-activity; sid:100000037; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.227.118.45"; content:"Host"; http_header; classtype:trojan-activity; sid:100000038; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.231.13.161"; content:"Host"; http_header; classtype:trojan-activity; sid:100000039; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.240.211.121"; content:"Host"; http_header; classtype:trojan-activity; sid:100000040; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.245.10.51"; content:"Host"; http_header; classtype:trojan-activity; sid:100000041; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.245.237.10"; content:"Host"; http_header; classtype:trojan-activity; sid:100000042; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.247.164.242"; content:"Host"; http_header; classtype:trojan-activity; sid:100000043; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.36.80.114"; content:"Host"; http_header; classtype:trojan-activity; sid:100000044; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.54.153.49"; content:"Host"; http_header; classtype:trojan-activity; sid:100000045; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.59.134.98"; content:"Host"; http_header; classtype:trojan-activity; sid:100000046; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; content:"GET"; http_method; content:"103.68.95.197"; content:"Host"; http_header; classtype:trojan-activity; sid:100000047; rev:1;)
Nach oben scrollen