urlhaus-filter (Snort 3)

By /
by Ming Di Leom Malware
https://malware-filter.gitlab.io/malware-filter/urlhaus-filter-snort3-online.rules Open raw list
24.3kentries
+24.3k -24.2klast change
last updated
7.2 MBsize
19 hours agolast checked

Description

Filter list covering malware. Maintained by Ming Di Leom. See the project homepage for details and inclusion criteria.

Integration

No specific instructions available. Add the list URL to your blocker:

https://malware-filter.gitlab.io/malware-filter/urlhaus-filter-snort3-online.rules

Recent changes

Recently added entries

  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.92.101.221",nocase; classtype:trojan-activity; sid:100000001; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.92.136.152",nocase; classtype:trojan-activity; sid:100000002; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.94.221.183",nocase; classtype:trojan-activity; sid:100000003; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.95.51.146",nocase; classtype:trojan-activity; sid:100000004; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.126.11.168",nocase; classtype:trojan-activity; sid:100000005; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.200.193.211",nocase; classtype:trojan-activity; sid:100000006; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.200.220.118",nocase; classtype:trojan-activity; sid:100000007; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.23.121.201",nocase; classtype:trojan-activity; sid:100000008; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.43.49.183",nocase; classtype:trojan-activity; sid:100000009; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.59.79.119",nocase; classtype:trojan-activity; sid:100000010; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.74.154.151",nocase; classtype:trojan-activity; sid:100000011; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.212.61.41",nocase; classtype:trojan-activity; sid:100000012; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.216.105.81",nocase; classtype:trojan-activity; sid:100000013; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.220.160.142",nocase; classtype:trojan-activity; sid:100000014; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.220.160.223",nocase; classtype:trojan-activity; sid:100000015; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.220.160.93",nocase; classtype:trojan-activity; sid:100000016; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.220.161.39",nocase; classtype:trojan-activity; sid:100000017; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.23.89.5",nocase; classtype:trojan-activity; sid:100000018; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.53.15.17",nocase; classtype:trojan-activity; sid:100000019; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.152.141.10",nocase; classtype:trojan-activity; sid:100000028; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.163.119.220",nocase; classtype:trojan-activity; sid:100000029; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.164.117.74",nocase; classtype:trojan-activity; sid:100000030; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.164.200.170",nocase; classtype:trojan-activity; sid:100000031; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.168.67.55",nocase; classtype:trojan-activity; sid:100000032; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.171.168.74",nocase; classtype:trojan-activity; sid:100000033; rev:1;)

Recently removed entries

  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.62.87.116",nocase; classtype:trojan-activity; sid:100000001; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.92.101.221",nocase; classtype:trojan-activity; sid:100000002; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.92.136.152",nocase; classtype:trojan-activity; sid:100000003; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.94.221.183",nocase; classtype:trojan-activity; sid:100000004; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"1.95.51.146",nocase; classtype:trojan-activity; sid:100000005; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.126.11.168",nocase; classtype:trojan-activity; sid:100000006; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.200.193.211",nocase; classtype:trojan-activity; sid:100000007; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.200.220.118",nocase; classtype:trojan-activity; sid:100000008; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.23.121.201",nocase; classtype:trojan-activity; sid:100000009; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.35.56.7",nocase; classtype:trojan-activity; sid:100000010; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.43.49.183",nocase; classtype:trojan-activity; sid:100000011; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"101.74.154.151",nocase; classtype:trojan-activity; sid:100000012; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.212.61.41",nocase; classtype:trojan-activity; sid:100000013; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.216.105.81",nocase; classtype:trojan-activity; sid:100000014; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.220.160.142",nocase; classtype:trojan-activity; sid:100000015; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.220.160.223",nocase; classtype:trojan-activity; sid:100000016; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.220.160.93",nocase; classtype:trojan-activity; sid:100000017; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.220.161.39",nocase; classtype:trojan-activity; sid:100000018; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"102.23.89.5",nocase; classtype:trojan-activity; sid:100000019; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.125.174.116",nocase; classtype:trojan-activity; sid:100000028; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.126.201.130",nocase; classtype:trojan-activity; sid:100000029; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.140.87.105",nocase; classtype:trojan-activity; sid:100000030; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.152.141.10",nocase; classtype:trojan-activity; sid:100000031; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.159.152.118",nocase; classtype:trojan-activity; sid:100000032; rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; http_header:field host; content:"103.163.119.220",nocase; classtype:trojan-activity; sid:100000033; rev:1;)
Scroll to Top