phishing-filter (Snort 2)

By /
by Ming Di Leom Phishing
https://malware-filter.gitlab.io/malware-filter/phishing-filter-snort2.rules Open raw list
66.0kentries
+66.0k -65.8klast change
last updated
19.0 MBsize
8 hours agolast checked

Description

Filter list covering phishing. Maintained by Ming Di Leom. See the project homepage for details and inclusion criteria.

Integration

No specific instructions available. Add the list URL to your blocker:

https://malware-filter.gitlab.io/malware-filter/phishing-filter-snort2.rules

Recent changes

Recently added entries

  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0668ka.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000042; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"06d6ie-3j9aw-hg4xco-jhjx3.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000043; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"06egte3.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000044; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"06t-xiy883-tl87j-xoae-ffyrj.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000045; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0800numbers-uk.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200000046; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0898yczc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000047; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"08yw-wdxv-wbds-ynvme-ojl0fa.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000048; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09-appelmanques.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000049; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09-uludag-edu-tr.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000050; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09.2026x02find.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000051; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"090675.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000052; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0918784avispdf.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000053; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09248ar.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000054; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0932es.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000055; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"093421tr.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000056; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"093748ci.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000057; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0938jp.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000058; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0938roundcube.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000059; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09392.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000060; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"094847.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000061; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09636.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000062; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0975896749.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000063; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"097ey43.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000064; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0988576657456223.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000065; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0auth2.1mb.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200000066; rev:1;)

Recently removed entries

  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"06d6ie-3j9aw-hg4xco-jhjx3.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000042; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"06egte3.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000043; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"06t-xiy883-tl87j-xoae-ffyrj.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000044; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0800numbers-uk.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200000045; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"08yw-wdxv-wbds-ynvme-ojl0fa.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000046; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09-appelmanques.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000047; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09-uludag-edu-tr.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000048; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09.2026x02find.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000049; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"090675.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000050; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0918784avispdf.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000051; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09248ar.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000052; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0932es.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000053; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"093421tr.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000054; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"093748ci.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000055; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0938jp.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000056; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0938roundcube.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000057; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09392.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000058; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"094847.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000059; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09636.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000060; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0975896749.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000061; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"097ey43.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000062; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0988576657456223.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000063; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0auth2.1mb.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200000064; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0btu8g.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000065; rev:1;)
  • alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0d9a56c5-6a18-4f41-9dcf-1fa0531f9645-00-3s6jlesunorig.riker.replit.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000066; rev:1;)
Scroll to Top