phishing-filter (Suricata)

By /
by Ming Di Leom Phishing
https://malware-filter.gitlab.io/malware-filter/phishing-filter-suricata.rules Open raw list
66.0kentries
+66.0k -65.8klast change
last updated
17.8 MBsize
2 hours agolast checked

Description

Filter list covering phishing. Maintained by Ming Di Leom. See the project homepage for details and inclusion criteria.

Integration

No specific instructions available. Add the list URL to your blocker:

https://malware-filter.gitlab.io/malware-filter/phishing-filter-suricata.rules

Recent changes

Recently added entries

  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0668ka.com"; classtype:attempted-recon; sid:200000042 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"06d6ie-3j9aw-hg4xco-jhjx3.pages.dev"; classtype:attempted-recon; sid:200000043 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"06egte3.top"; classtype:attempted-recon; sid:200000044 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"06t-xiy883-tl87j-xoae-ffyrj.pages.dev"; classtype:attempted-recon; sid:200000045 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0800numbers-uk.co.uk"; classtype:attempted-recon; sid:200000046 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0898yczc.com"; classtype:attempted-recon; sid:200000047 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"08yw-wdxv-wbds-ynvme-ojl0fa.pages.dev"; classtype:attempted-recon; sid:200000048 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"09-appelmanques.weebly.com"; classtype:attempted-recon; sid:200000049 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"09-uludag-edu-tr.weebly.com"; classtype:attempted-recon; sid:200000050 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"09.2026x02find.shop"; classtype:attempted-recon; sid:200000051 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"090675.weebly.com"; classtype:attempted-recon; sid:200000052 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0918784avispdf.weebly.com"; classtype:attempted-recon; sid:200000053 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"09248ar.weebly.com"; classtype:attempted-recon; sid:200000054 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0932es.weebly.com"; classtype:attempted-recon; sid:200000055 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"093421tr.weebly.com"; classtype:attempted-recon; sid:200000056 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"093748ci.weebly.com"; classtype:attempted-recon; sid:200000057 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0938jp.weebly.com"; classtype:attempted-recon; sid:200000058 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0938roundcube.weebly.com"; classtype:attempted-recon; sid:200000059 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"09392.weebly.com"; classtype:attempted-recon; sid:200000060 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"094847.webflow.io"; classtype:attempted-recon; sid:200000061 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"09636.weebly.com"; classtype:attempted-recon; sid:200000062 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0975896749.weebly.com"; classtype:attempted-recon; sid:200000063 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"097ey43.top"; classtype:attempted-recon; sid:200000064 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0988576657456223.weebly.com"; classtype:attempted-recon; sid:200000065 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0auth2.1mb.site"; classtype:attempted-recon; sid:200000066 rev:1;)

Recently removed entries

  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"06d6ie-3j9aw-hg4xco-jhjx3.pages.dev"; classtype:attempted-recon; sid:200000042 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"06egte3.top"; classtype:attempted-recon; sid:200000043 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"06t-xiy883-tl87j-xoae-ffyrj.pages.dev"; classtype:attempted-recon; sid:200000044 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0800numbers-uk.co.uk"; classtype:attempted-recon; sid:200000045 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"08yw-wdxv-wbds-ynvme-ojl0fa.pages.dev"; classtype:attempted-recon; sid:200000046 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"09-appelmanques.weebly.com"; classtype:attempted-recon; sid:200000047 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"09-uludag-edu-tr.weebly.com"; classtype:attempted-recon; sid:200000048 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"09.2026x02find.shop"; classtype:attempted-recon; sid:200000049 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"090675.weebly.com"; classtype:attempted-recon; sid:200000050 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0918784avispdf.weebly.com"; classtype:attempted-recon; sid:200000051 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"09248ar.weebly.com"; classtype:attempted-recon; sid:200000052 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0932es.weebly.com"; classtype:attempted-recon; sid:200000053 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"093421tr.weebly.com"; classtype:attempted-recon; sid:200000054 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"093748ci.weebly.com"; classtype:attempted-recon; sid:200000055 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0938jp.weebly.com"; classtype:attempted-recon; sid:200000056 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0938roundcube.weebly.com"; classtype:attempted-recon; sid:200000057 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"09392.weebly.com"; classtype:attempted-recon; sid:200000058 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"094847.webflow.io"; classtype:attempted-recon; sid:200000059 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"09636.weebly.com"; classtype:attempted-recon; sid:200000060 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0975896749.weebly.com"; classtype:attempted-recon; sid:200000061 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"097ey43.top"; classtype:attempted-recon; sid:200000062 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0988576657456223.weebly.com"; classtype:attempted-recon; sid:200000063 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0auth2.1mb.site"; classtype:attempted-recon; sid:200000064 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0btu8g.icu"; classtype:attempted-recon; sid:200000065 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0d9a56c5-6a18-4f41-9dcf-1fa0531f9645-00-3s6jlesunorig.riker.replit.dev"; classtype:attempted-recon; sid:200000066 rev:1;)
Scroll to Top