phishing-filter (Suricata)

By /
by Ming Di Leom Phishing
https://malware-filter.gitlab.io/malware-filter/phishing-filter-suricata.rules Open raw list
56.4kentries
+56.3k -58.9klast change
last updated
15.3 MBsize
20 hours agolast checked

Description

Filter list covering phishing. Maintained by Ming Di Leom. See the project homepage for details and inclusion criteria.

Integration

No specific instructions available. Add the list URL to your blocker:

https://malware-filter.gitlab.io/malware-filter/phishing-filter-suricata.rules

Recent changes

Recently added entries

  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"02p4h4.bitrix24.site"; classtype:attempted-recon; sid:200000029 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"02twg3.top"; classtype:attempted-recon; sid:200000030 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"035261.weebly.com"; classtype:attempted-recon; sid:200000031 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"03avtd.weebly.com"; classtype:attempted-recon; sid:200000032 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"03nlvk-3xo43-lut5i-lu9-n95ug.pages.dev"; classtype:attempted-recon; sid:200000033 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0465kk.com"; classtype:attempted-recon; sid:200000034 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"06-0040-0-3986-7356-1324992141.cos.ap-jakarta.myqcloud.com"; classtype:attempted-recon; sid:200000035 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"06egte3.top"; classtype:attempted-recon; sid:200000036 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"06t-xiy883-tl87j-xoae-ffyrj.pages.dev"; classtype:attempted-recon; sid:200000037 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0800numbers-uk.co.uk"; classtype:attempted-recon; sid:200000038 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0898yczc.com"; classtype:attempted-recon; sid:200000039 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"08yw-wdxv-wbds-ynvme-ojl0fa.pages.dev"; classtype:attempted-recon; sid:200000040 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"09-uludag-edu-tr.weebly.com"; classtype:attempted-recon; sid:200000041 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"09.2026x02find.shop"; classtype:attempted-recon; sid:200000042 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"090675.weebly.com"; classtype:attempted-recon; sid:200000043 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0987521532.weebly.com"; classtype:attempted-recon; sid:200000054 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0aj-23x92-ovp6-32k4-9fn5c.pages.dev"; classtype:attempted-recon; sid:200000055 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0auth2.1mb.site"; classtype:attempted-recon; sid:200000056 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0bsj77.info"; classtype:attempted-recon; sid:200000057 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0bzy48-d2wkgv-ol8-2ou6p6.pages.dev"; classtype:attempted-recon; sid:200000058 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0d9a56c5-6a18-4f41-9dcf-1fa0531f9645-00-3s6jlesunorig.riker.replit.dev"; classtype:attempted-recon; sid:200000059 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0dx829.info"; classtype:attempted-recon; sid:200000060 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0e37e6ed-727f-469f-8fd4-4e262b9cdc59.s3.us-west-2.amazonaws.com"; classtype:attempted-recon; sid:200000061 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0e7h4hr.top"; classtype:attempted-recon; sid:200000062 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0e87599127.nxcli.io"; classtype:attempted-recon; sid:200000063 rev:1;)

Recently removed entries

  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"02twg3.top"; classtype:attempted-recon; sid:200000029 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"035261.weebly.com"; classtype:attempted-recon; sid:200000030 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"03avtd.weebly.com"; classtype:attempted-recon; sid:200000031 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"03nlvk-3xo43-lut5i-lu9-n95ug.pages.dev"; classtype:attempted-recon; sid:200000032 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0465kk.com"; classtype:attempted-recon; sid:200000033 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"06-0040-0-3986-7356-1324992141.cos.ap-jakarta.myqcloud.com"; classtype:attempted-recon; sid:200000034 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"06egte3.top"; classtype:attempted-recon; sid:200000035 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"06t-xiy883-tl87j-xoae-ffyrj.pages.dev"; classtype:attempted-recon; sid:200000036 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0800numbers-uk.co.uk"; classtype:attempted-recon; sid:200000037 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0898yczc.com"; classtype:attempted-recon; sid:200000038 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"08yw-wdxv-wbds-ynvme-ojl0fa.pages.dev"; classtype:attempted-recon; sid:200000039 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"09-uludag-edu-tr.weebly.com"; classtype:attempted-recon; sid:200000040 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"09.2026x02find.shop"; classtype:attempted-recon; sid:200000041 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"090675.weebly.com"; classtype:attempted-recon; sid:200000042 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0918784avispdf.weebly.com"; classtype:attempted-recon; sid:200000043 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0auth2.1mb.site"; classtype:attempted-recon; sid:200000054 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0bsj77.info"; classtype:attempted-recon; sid:200000055 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0c3ba2.info"; classtype:attempted-recon; sid:200000056 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0d9a56c5-6a18-4f41-9dcf-1fa0531f9645-00-3s6jlesunorig.riker.replit.dev"; classtype:attempted-recon; sid:200000057 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0dx829.info"; classtype:attempted-recon; sid:200000058 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0e37e6ed-727f-469f-8fd4-4e262b9cdc59.s3.us-west-2.amazonaws.com"; classtype:attempted-recon; sid:200000059 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0e7h4hr.top"; classtype:attempted-recon; sid:200000060 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0e87599127.nxcli.io"; classtype:attempted-recon; sid:200000061 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0ej37yhe.cfd"; classtype:attempted-recon; sid:200000062 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"0er-2qet17-3lr-lfm-4hjt-uym9.pages.dev"; classtype:attempted-recon; sid:200000063 rev:1;)
Scroll to Top