Antiphishing — Predictive Phishing Intelligence for Suricata

[DONATE] · DASHBOARD VECTORS · CONTRIBUTING · SUBMIT A VECTOR · REST API CTI · WIKI

Predictive Phishing Intelligence for Suricata — Preemptive Defense from Day Zero

Antiphishing is an open-source (GPLv3) Cyber Threat Intelligence (CTI) infrastructure and Suricata ruleset designed to identify and disrupt phishing infrastructure as early as possible at the network layer.

The project combines curated phishing indicators, automated threat intelligence processing, and analysis of Newly Registered Domains (NRDs) to identify suspicious emerging infrastructure before it becomes widely recognized by conventional threat feeds.

Antiphishing is designed to transform emerging threat intelligence into deployable Suricata detection and prevention rules.

---

⚡ Predictive Defense: From Newly Registered Domains to Early Detection

Modern phishing infrastructure can be created, weaponized, and abandoned within a short period of time.

Traditional blocklists are valuable, but they generally identify infrastructure after indicators have already been observed, reported, or validated.

Antiphishing explores a complementary approach: preemptive threat intelligence.

The NRD pipeline monitors newly registered domains with observed DNS activity and analyzes candidate domains using multiple heuristics, including:

• Typosquatting detection
• Homoglyph detection
• Brand impersonation patterns
• Suspicious keywords
• Domain similarity analysis
• Other indicators derived from the project's analysis pipeline

The pipeline analyzes more than 1.5 million candidate domain combinations and produces a set of domains considered suspicious enough for further security action.

The objective is not to claim that every newly registered domain is malicious. Instead, the goal is to identify potential phishing infrastructure at an early stage, before it necessarily appears in conventional malicious-domain feeds.

This creates a complementary detection layer between raw infrastructure registration and confirmed malicious intelligence.

The Day-Zero Concept

The term Day Zero in Antiphishing refers to the project's goal of reducing the time between the emergence of suspicious infrastructure and defensive action.

It does not mean that Antiphishing can detect every zero-day attack, vulnerability, or previously unknown malware family.

The focus is narrower and practical:

Identify suspicious phishing infrastructure as early as possible and make that intelligence actionable at the network layer.

---

🛡️ Radical Transparency: Suspicious Does Not Mean Confirmed Malicious

Predictive intelligence requires a different confidence model from traditional validated IOC feeds.

Domains generated by the NRD analysis pipeline are candidate indicators produced through automated heuristics. They should therefore be treated as highly suspicious infrastructure, rather than automatically interpreted as manually validated malicious IOCs.

⚠️ False Positive Consideration

Because the NRD pipeline prioritizes early detection, false positives are possible.

Organizations deploying predictive indicators should consider appropriate:

• Whitelisting
• Monitoring
• Alert tuning
• Risk-based enforcement
• Validation workflows

The NRD-derived intelligence is particularly suited to environments where early blocking of suspicious infrastructure is preferable to waiting for a domain to become a confirmed malicious IOC.

This is a deliberate trade-off:

Earlier intelligence can provide earlier protection, but earlier intelligence also carries greater uncertainty.

---

🧠 Threat Intelligence Pipeline

Antiphishing is more than a static phishing blocklist.

The project combines multiple sources and processing stages:

External Threat Feeds
        │
        ├── Phishing indicators
        │
        └── Infrastructure indicators
                 │
                 ▼
        ┌───────────────────┐
        │ Intelligence      │
        │ Processing        │
        └───────────────────┘
                 │
                 ├── Domain analysis
                 ├── IP analysis
                 └── URL processing
                 │
                 ▼
        Newly Registered Domains
                 │
                 ▼
        Candidate Generation
                 │
                 ├── Typosquatting
                 ├── Homoglyphs
                 ├── Keywords
                 └── Brand impersonation
                 │
                 ▼
        Suspicious Infrastructure
                 │
                 ▼
        Suricata Detection
                 │
                 ▼
        IDS / IPS Enforcement

The project also relies on external free software, open-source libraries, public intelligence sources, and community APIs.

Antiphishing's role is to combine these components into an automated intelligence and detection pipeline.

---

⚙️ Detection Layers

The main Suricata ruleset (antiphishing.rules) provides multiple detection layers.

Important: Whether a matching rule generates an alert or actively blocks traffic depends on how Suricata is deployed and configured, particularly whether it is operating in IDS or IPS mode.

DNS

Detection of suspicious domains during DNS inspection using:

dns.query

The native Suricata dataset contains the domain intelligence used by the DNS signature.

TLS

Detection through the TLS Server Name Indication (SNI):

tls.sni

This allows domain-based detection without decrypting HTTPS traffic.

HTTP

Inspection of HTTP traffic and phishing URLs using application-layer signatures.

HTTP detection can provide more specific visibility into the requested resource when the traffic is available for inspection.

IPv4

Detection of connections to known phishing infrastructure using destination IPv4 intelligence.

The main ruleset uses Suricata's dataset mechanism for this intelligence.

---

📦 Datasets

The main Antiphishing ruleset uses native Suricata external datasets.

Phishing Domains

phishing.lst

Domain intelligence used by the DNS and TLS dataset signatures.

The domain dataset is maintained separately from the Suricata signature file because it contains dataset values rather than Suricata signatures.

Phishing IPv4

phishing_ips.lst

IPv4 indicators used by the destination-IP dataset signature.

NRD Suspicious Domains

nrd_suspicious_domains.txt

Domains generated by the NRD analysis pipeline and classified as suspicious candidates.

Important: NRD-derived domains are predictive intelligence and should not automatically be interpreted as confirmed malicious indicators.

---

🔌 OPNsense Integration

Antiphishing is integrated with the OPNsense IDS/IPS ecosystem through:

os-intrusion-detection-content-at-antiphishing

The OPNsense integration is currently not equivalent to the full native Antiphishing ruleset.

Current status

The existing OPNsense integration reliably provides the HTTP signatures.