urlhaus-filter (Suricata)

By /
by Ming Di Leom Malware
https://malware-filter.gitlab.io/malware-filter/urlhaus-filter-suricata-online.rules Open raw list
24.3kentries
+24.3k -24.2klast change
last updated
8.4 MBsize
20 hours agolast checked

Description

Filter list covering malware. Maintained by Ming Di Leom. See the project homepage for details and inclusion criteria.

Integration

No specific instructions available. Add the list URL to your blocker:

https://malware-filter.gitlab.io/malware-filter/urlhaus-filter-suricata-online.rules

Recent changes

Recently added entries

  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.92.101.221"; classtype:trojan-activity; sid:100000001 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.92.136.152"; classtype:trojan-activity; sid:100000002 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.94.221.183"; classtype:trojan-activity; sid:100000003 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.95.51.146"; classtype:trojan-activity; sid:100000004 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.126.11.168"; classtype:trojan-activity; sid:100000005 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.200.193.211"; classtype:trojan-activity; sid:100000006 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.200.220.118"; classtype:trojan-activity; sid:100000007 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.23.121.201"; classtype:trojan-activity; sid:100000008 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.43.49.183"; classtype:trojan-activity; sid:100000009 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.59.79.119"; classtype:trojan-activity; sid:100000010 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.74.154.151"; classtype:trojan-activity; sid:100000011 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.212.61.41"; classtype:trojan-activity; sid:100000012 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.216.105.81"; classtype:trojan-activity; sid:100000013 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.220.160.142"; classtype:trojan-activity; sid:100000014 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.220.160.223"; classtype:trojan-activity; sid:100000015 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.220.160.93"; classtype:trojan-activity; sid:100000016 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.220.161.39"; classtype:trojan-activity; sid:100000017 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.23.89.5"; classtype:trojan-activity; sid:100000018 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.53.15.17"; classtype:trojan-activity; sid:100000019 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.152.141.10"; classtype:trojan-activity; sid:100000028 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.163.119.220"; classtype:trojan-activity; sid:100000029 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.164.117.74"; classtype:trojan-activity; sid:100000030 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.164.200.170"; classtype:trojan-activity; sid:100000031 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.168.67.55"; classtype:trojan-activity; sid:100000032 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.171.168.74"; classtype:trojan-activity; sid:100000033 rev:1;)

Recently removed entries

  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.62.87.116"; classtype:trojan-activity; sid:100000001 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.92.101.221"; classtype:trojan-activity; sid:100000002 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.92.136.152"; classtype:trojan-activity; sid:100000003 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.94.221.183"; classtype:trojan-activity; sid:100000004 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.95.51.146"; classtype:trojan-activity; sid:100000005 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.126.11.168"; classtype:trojan-activity; sid:100000006 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.200.193.211"; classtype:trojan-activity; sid:100000007 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.200.220.118"; classtype:trojan-activity; sid:100000008 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.23.121.201"; classtype:trojan-activity; sid:100000009 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.35.56.7"; classtype:trojan-activity; sid:100000010 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.43.49.183"; classtype:trojan-activity; sid:100000011 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.74.154.151"; classtype:trojan-activity; sid:100000012 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.212.61.41"; classtype:trojan-activity; sid:100000013 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.216.105.81"; classtype:trojan-activity; sid:100000014 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.220.160.142"; classtype:trojan-activity; sid:100000015 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.220.160.223"; classtype:trojan-activity; sid:100000016 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.220.160.93"; classtype:trojan-activity; sid:100000017 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.220.161.39"; classtype:trojan-activity; sid:100000018 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.23.89.5"; classtype:trojan-activity; sid:100000019 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.125.174.116"; classtype:trojan-activity; sid:100000028 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.126.201.130"; classtype:trojan-activity; sid:100000029 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.140.87.105"; classtype:trojan-activity; sid:100000030 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.152.141.10"; classtype:trojan-activity; sid:100000031 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.159.152.118"; classtype:trojan-activity; sid:100000032 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.163.119.220"; classtype:trojan-activity; sid:100000033 rev:1;)
Scroll to Top