Antiphishing — Predictive Phishing Intelligence for Suricata

[DONATE] · DASHBOARD VECTORS · CONTRIBUTING · SUBMIT A VECTOR · REST API CTI · WIKI

Predictive Phishing Intelligence for Suricata — Preemptive Defense from Day Zero

Antiphishing is an open-source (GPLv3) Cyber Threat Intelligence (CTI) infrastructure and Suricata ruleset designed to identify and disrupt phishing infrastructure as early as possible at the network layer.

The project combines curated phishing indicators, automated threat intelligence processing, and analysis of Newly Registered Domains (NRDs) to identify suspicious emerging infrastructure before it becomes widely recognized by conventional threat feeds.

Antiphishing is designed to transform emerging threat intelligence into deployable Suricata detection and prevention rules.

⚡ Predictive Defense: From Newly Registered Domains to Early Detection

Modern phishing infrastructure can be created, weaponized, and abandoned within a short period of time.

Traditional blocklists are valuable, but they generally identify infrastructure after indicators have already been observed, reported, or validated.

Antiphishing explores a complementary approach: preemptive threat intelligence.

The NRD pipeline monitors newly registered domains with observed DNS activity and analyzes candidate domains using multiple heuristics, including:

• Typosquatting detection
• Homoglyph detection
• Brand impersonation patterns
• Suspicious keywords
• Domain similarity analysis
• Other indicators derived from the project's analysis pipeline

The pipeline analyzes more than 1.5 million candidate domain combinations and produces a set of domains considered suspicious enough for further security action.

The objective is not to claim that every newly registered domain is malicious. Instead, the goal is to identify potential phishing infrastructure at an early stage, before it necessarily appears in conventional malicious-domain feeds.

This creates a complementary detection layer between raw infrastructure registration and confirmed malicious intelligence.

The Day-Zero Concept

The term Day Zero in Antiphishing refers to the project's goal of reducing the time between the emergence of suspicious infrastructure and defensive action.

It does not mean that Antiphishing can detect every zero-day attack, vulnerability, or previously unknown malware family.

The focus is narrower and practical:

Identify suspicious phishing infrastructure as early as possible and make that intelligence actionable at the network layer.

🛡️ Radical Transparency: Suspicious Does Not Mean Confirmed Malicious

Predictive intelligence requires a different confidence model from traditional validated IOC feeds.

Domains generated by the NRD analysis pipeline are candidate indicators produced through automated heuristics. They should therefore be treated as highly suspicious infrastructure, rather than automatically interpreted as manually validated malicious IOCs.

⚠️ False Positive Consideration

Because the NRD pipeline prioritizes early detection, false positives are possible.

Organizations deploying predictive indicators should consider appropriate:

• Whitelisting
• Monitoring
• Alert tuning
• Risk-based enforcement
• Validation workflows

The NRD-derived intelligence is particularly suited to environments where early blocking of suspicious infrastructure is preferable to waiting for a domain to become a confirmed malicious IOC.

This is a deliberate trade-off:

Earlier intelligence can provide earlier protection, but earlier intelligence also carries greater uncertainty.

🧠 Threat Intelligence Pipeline

Antiphishing is more than a static phishing blocklist.

The project combines multiple sources and processing stages:

External Threat Feeds
        │
        ├── Phishing indicators
        │
        └── Infrastructure indicators
                 │
                 ▼
        ┌───────────────────┐
        │ Intelligence      │
        │ Processing        │
        └───────────────────┘
                 │
                 ├── Domain analysis
                 ├── IP analysis
                 └── URL processing
                 │
                 ▼
        Newly Registered Domains
                 │
                 ▼
        Candidate Generation
                 │
                 ├── Typosquatting
                 ├── Homoglyphs
                 ├── Keywords
                 └── Brand impersonation
                 │
                 ▼
        Suspicious Infrastructure
                 │
                 ▼
        Suricata Detection
                 │
                 ▼
        IDS / IPS Enforcement

The project also relies on external free software, open-source libraries, public intelligence sources, and community APIs.

Antiphishing's role is to combine these components into an automated intelligence and detection pipeline.

⚙️ Detection Layers

The main Suricata ruleset (antiphishing.rules) provides multiple detection layers.

Important: Whether a matching rule generates an alert or actively blocks traffic depends on how Suricata is deployed and configured, particularly whether it is operating in IDS or IPS mode.

DNS

Detection of suspicious domains during DNS inspection using:

dns.query

The native Suricata dataset contains the domain intelligence used by the DNS signature.

TLS

Detection through the TLS Server Name Indication (SNI):

tls.sni

This allows domain-based detection without decrypting HTTPS traffic.

HTTP

Inspection of HTTP traffic and phishing URLs using application-layer signatures.

HTTP detection can provide more specific visibility into the requested resource when the traffic is available for inspection.

IPv4

Detection of connections to known phishing infrastructure using destination IPv4 intelligence.

The main ruleset uses Suricata's dataset mechanism for this intelligence.

📦 Datasets

The main Antiphishing ruleset uses native Suricata external datasets.

Phishing Domains

phishing.lst

Domain intelligence used by the DNS and TLS dataset signatures.

The domain dataset is maintained separately from the Suricata signature file because it contains dataset values rather than Suricata signatures.

Phishing IPv4

phishing_ips.lst

IPv4 indicators used by the destination-IP dataset signature.

NRD Suspicious Domains

nrd_suspicious_domains.txt

Domains generated by the NRD analysis pipeline and classified as suspicious candidates.

Important: NRD-derived domains are predictive intelligence and should not automatically be interpreted as confirmed malicious indicators.

🔌 OPNsense Integration

Antiphishing is integrated with the OPNsense IDS/IPS ecosystem through:

os-intrusion-detection-content-at-antiphishing

The OPNsense integration is currently not equivalent to the full native Antiphishing ruleset.

Current status

The existing OPNsense integration reliably provides the HTTP signatures.

The external DNS, TLS, and IPv4 datasets require additional handling because the OPNsense IDS content framework does not currently provide a uniform mechanism for distributing and loading external Suricata dataset files.

The main Antiphishing ruleset continues to use Suricata's native dataset implementation and is not changed to accommodate this OPNsense limitation.

An OPNsense-specific ruleset is being investigated and tested separately.

OPNsense users should therefore verify the capabilities of the specific distributed ruleset before assuming that all Antiphishing detection layers are active.

The project aims to provide a stable OPNsense integration rather than shipping a configuration that can cause Suricata to fail during startup or reload.

📁 Direct Distribution Links

Main Suricata Ruleset

antiphishing.rules

https://github.com/julioliraup/Antiphishing/raw/refs/heads/main/antiphishing.rules

The main ruleset uses the external datasets described above.

OPNsense Ruleset

antiphishing-opnsense.rules

https://github.com/julioliraup/Antiphishing/raw/refs/heads/main/antiphishing-opnsense.rules

This file is an OPNsense-specific compatibility variant and may not provide the same detection coverage as the main ruleset.

Phishing Domains Dataset

phishing.lst

https://github.com/julioliraup/Antiphishing/raw/refs/heads/main/phishing.lst

Base64-encoded Suricata dataset.

Phishing IPv4 Dataset

phishing_ips.lst

https://github.com/julioliraup/Antiphishing/raw/refs/heads/main/phishing_ips.lst

Plain-text IPv4 dataset.

NRD Suspicious Domains

nrd_suspicious_domains.txt

https://github.com/julioliraup/Antiphishing/raw/refs/heads/main/nrd_suspicious_domains.txt

NRD-derived suspicious-domain intelligence.

🚀 Installation

Antiphishing is designed to integrate with Suricata and suricata-update.

The preferred installation method depends on the target platform.

GNU/Linux

See the installation and configuration guide:

https://github.com/julioliraup/Antiphishing/wiki/Configuration-Ruleset-on-GNU-Linux

pfSense

https://github.com/julioliraup/Antiphishing/wiki/Configuration-Ruleset-on-pfSense

IDSTower

https://github.com/julioliraup/Antiphishing/wiki/Configuration:-Antiphishing-Ruleset-on-IDSTower

OPNsense

The Antiphishing ruleset is available through the OPNsense IDS/IPS content ecosystem.

See the OPNsense documentation and the project wiki for the current integration status and installation procedure.

Upcoming Guides

🔄 Updates & Automation

The Antiphishing intelligence pipeline is updated dynamically approximately every 6 hours to track emerging phishing infrastructure.

The update pipeline processes intelligence from multiple sources and regenerates the Suricata rules and datasets.

Suricata Integration

The project is designed for integration with:

• suricata-update
• Suricata IDS
• Suricata IPS
• Firewall platforms using Suricata
• Security monitoring environments

SID Allocation

Antiphishing uses the following SID range:

6000000 - 6100000

SIDs are carefully assigned within the project to avoid internal collisions.

📊 Intelligence and Transparency

Antiphishing exposes its intelligence through public infrastructure so that users can inspect, evaluate, and integrate the data into their own security workflows.

Available components include:

• Public threat-intelligence dashboard
• Suricata rules
• Domain datasets
• IPv4 datasets
• NRD-derived suspicious-domain intelligence
• REST API
• Documentation
• Community issue tracking

The project intentionally exposes its detection infrastructure instead of treating the detection methodology as a black box.

🌐 Open-Source Ecosystem

Antiphishing is built on top of and alongside the broader open-source security ecosystem.

The project makes use of external:

• Threat feeds
• Public APIs
• Open-source libraries
• Domain-analysis tools
• DNS infrastructure
• Suricata
• Suricata-update

Antiphishing does not claim ownership of the underlying intelligence sources or tools it consumes.

Its primary contribution is the automation, correlation, analysis pipeline, and conversion of intelligence into deployable Suricata detection content.

🙏 Acknowledgments

A special and sincere thanks to @antixmars, @sikysikov, @satta, @flipper203, and @zoomequipd for their contributions, insights, testing, and support.

Antiphishing is a collaborative ecosystem, and community feedback is an important part of improving the project's detection quality and platform compatibility.

💛 Support This Project

Antiphishing is maintained as an independent, public security infrastructure.

The project aims to make proactive phishing intelligence and network-level detection available without requiring organizations to purchase a commercial threat-intelligence platform.

However, operating a continuously updated intelligence pipeline has real infrastructure and operational costs.

Support helps fund:

API and Intelligence

• Commercial API access
• Historical WHOIS data
• Reverse DNS
• Domain analytics
• Additional intelligence sources

NRD Processing

The NRD analysis pipeline requires substantial CPU and memory resources to process large numbers of candidate domain combinations.

Infrastructure

Sponsorship also helps maintain:

• VPS infrastructure
• REST API services
• Public dashboards
• Ruleset distribution
• Automated processing
• Continuous updates

🏢 Corporate Support

For MSSPs, SOCs, security teams, researchers, and organizations using Antiphishing in production:

Antiphishing provides an open-source approach to predictive phishing intelligence and network-level enforcement through Suricata.

By supporting the project, organizations help maintain the infrastructure required to continuously process, analyze, and distribute emerging threat intelligence.

The goal is to keep the intelligence accessible to the community rather than placing the entire detection pipeline behind a commercial paywall.

🇧🇷 Support via PIX

If Antiphishing protects your network, supports your research, or saves your team time during incident response, consider supporting the infrastructure:

• PIX: 08650081401
• Beneficiary: Júlio Lira

🌐 GitHub Sponsors

For recurring support or one-time contributions:

https://github.com/sponsors/julioliraup

🤝 Contributing

Contributions are welcome.

You can contribute by:

• Reporting false positives
• Submitting phishing vectors
• Improving detection logic
• Testing platform integrations
• Improving documentation
• Reviewing rules
• Improving the intelligence pipeline
• Contributing code

See:

CONTRIBUTING.md

🐛 False Positives and Issues

Predictive intelligence necessarily involves uncertainty.

If you identify a false positive, incorrect indicator, detection problem, or integration issue, please open a GitHub Issue with as much technical information as possible.

Useful information may include:

• SID
• Domain/IP involved
• Detection protocol
• Suricata version
• Platform
• Relevant logs
• Reproduction steps

This information helps improve the detection pipeline while reducing unnecessary false positives.

📬 Contact

For security research, false positives, technical collaboration, or partnership discussions:

Email: [email protected]

Issues: https://github.com/julioliraup/Antiphishing/issues

🎯 Project Vision

Antiphishing is built around a simple principle:

Threat intelligence is most valuable when it becomes actionable before the attacker has time to establish a foothold.

The project combines open-source intelligence, automated analysis, emerging-domain research, and Suricata enforcement to explore a more proactive model of phishing defense.

Rather than waiting for every malicious domain to become a known IOC, Antiphishing investigates whether the infrastructure surrounding an emerging phishing campaign can provide useful defensive signals earlier.

That is the project's core idea:

From emerging infrastructure → to intelligence → to detection → to prevention.