urlhaus-filter (Snort 3)

Von /
von Ming Di Leom Malware Regex
https://malware-filter.gitlab.io/malware-filter/urlhaus-filter-snort3-online.rules Rohliste öffnen
24,3kEinträge
+24,3k -24,2kletzte Änderung
zuletzt aktualisiert
7,2 MBGröße
vor 18 Stundenzuletzt geprüft

Beschreibung

Filterliste aus den Bereichen Malware. Betreut von Ming Di Leom. Einzelheiten und Aufnahmekriterien stehen auf der Projektseite.

Integration

Add the list to the blocking.denylists section of your config.yml:

blocking:
  denylists:
    default:
      - https://malware-filter.gitlab.io/malware-filter/urlhaus-filter-snort3-online.rules
  clientGroupsBlock:
    default:
      - default

Restart Blocky afterwards.

Blocky Dokumentation

Letzte Änderungen

Kürzlich hinzugefügte Einträge

  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.92.101.221",nocase; classtype:trojan-activity; sid:100000001; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.92.136.152",nocase; classtype:trojan-activity; sid:100000002; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.94.221.183",nocase; classtype:trojan-activity; sid:100000003; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.95.51.146",nocase; classtype:trojan-activity; sid:100000004; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.126.11.168",nocase; classtype:trojan-activity; sid:100000005; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.200.193.211",nocase; classtype:trojan-activity; sid:100000006; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.200.220.118",nocase; classtype:trojan-activity; sid:100000007; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.23.121.201",nocase; classtype:trojan-activity; sid:100000008; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.43.49.183",nocase; classtype:trojan-activity; sid:100000009; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.59.79.119",nocase; classtype:trojan-activity; sid:100000010; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.74.154.151",nocase; classtype:trojan-activity; sid:100000011; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.212.61.41",nocase; classtype:trojan-activity; sid:100000012; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.216.105.81",nocase; classtype:trojan-activity; sid:100000013; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.220.160.142",nocase; classtype:trojan-activity; sid:100000014; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.220.160.223",nocase; classtype:trojan-activity; sid:100000015; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.220.160.93",nocase; classtype:trojan-activity; sid:100000016; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.220.161.39",nocase; classtype:trojan-activity; sid:100000017; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.23.89.5",nocase; classtype:trojan-activity; sid:100000018; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.53.15.17",nocase; classtype:trojan-activity; sid:100000019; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.152.141.10",nocase; classtype:trojan-activity; sid:100000028; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.163.119.220",nocase; classtype:trojan-activity; sid:100000029; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.164.117.74",nocase; classtype:trojan-activity; sid:100000030; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.164.200.170",nocase; classtype:trojan-activity; sid:100000031; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.168.67.55",nocase; classtype:trojan-activity; sid:100000032; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.171.168.74",nocase; classtype:trojan-activity; sid:100000033; rev:1;)

Kürzlich entfernte Einträge

  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.62.87.116",nocase; classtype:trojan-activity; sid:100000001; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.92.101.221",nocase; classtype:trojan-activity; sid:100000002; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.92.136.152",nocase; classtype:trojan-activity; sid:100000003; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.94.221.183",nocase; classtype:trojan-activity; sid:100000004; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.95.51.146",nocase; classtype:trojan-activity; sid:100000005; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.126.11.168",nocase; classtype:trojan-activity; sid:100000006; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.200.193.211",nocase; classtype:trojan-activity; sid:100000007; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.200.220.118",nocase; classtype:trojan-activity; sid:100000008; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.23.121.201",nocase; classtype:trojan-activity; sid:100000009; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.35.56.7",nocase; classtype:trojan-activity; sid:100000010; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.43.49.183",nocase; classtype:trojan-activity; sid:100000011; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.74.154.151",nocase; classtype:trojan-activity; sid:100000012; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.212.61.41",nocase; classtype:trojan-activity; sid:100000013; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.216.105.81",nocase; classtype:trojan-activity; sid:100000014; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.220.160.142",nocase; classtype:trojan-activity; sid:100000015; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.220.160.223",nocase; classtype:trojan-activity; sid:100000016; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.220.160.93",nocase; classtype:trojan-activity; sid:100000017; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.220.161.39",nocase; classtype:trojan-activity; sid:100000018; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.23.89.5",nocase; classtype:trojan-activity; sid:100000019; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.125.174.116",nocase; classtype:trojan-activity; sid:100000028; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.126.201.130",nocase; classtype:trojan-activity; sid:100000029; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.140.87.105",nocase; classtype:trojan-activity; sid:100000030; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.152.141.10",nocase; classtype:trojan-activity; sid:100000031; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.159.152.118",nocase; classtype:trojan-activity; sid:100000032; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.163.119.220",nocase; classtype:trojan-activity; sid:100000033; rev:1;)
Nach oben scrollen