julioliraup/antiphishingAdvanced Phishing Protection: Suricata rulesets open and free
[DONATE] · DASHBOARD VECTORS · CONTRIBUTING · SUBMIT A VECTOR · REST API CTI · WIKI
Predictive Phishing Intelligence for Suricata — Preemptive Defense from Day Zero
Antiphishing is an open-source (GPLv3) Cyber Threat Intelligence (CTI) infrastructure and Suricata ruleset designed to identify and disrupt phishing infrastructure as early as possible at the network layer.
The project combines curated phishing indicators, automated threat intelligence processing, and analysis of Newly Registered Domains (NRDs) to identify suspicious emerging infrastructure before it becomes widely recognized by conventional threat feeds.
Antiphishing is designed to transform emerging threat intelligence into deployable Suricata detection and prevention rules.
Modern phishing infrastructure can be created, weaponized, and abandoned within a short period of time.
Traditional blocklists are valuable, but they generally identify infrastructure after indicators have already been observed, reported, or validated.
Antiphishing explores a complementary approach: preemptive threat intelligence.
The NRD pipeline monitors newly registered domains with observed DNS activity and analyzes candidate domains using multiple heuristics, including:
The pipeline analyzes more than 1.5 million candidate domain combinations and produces a set of domains considered suspicious enough for further security action.
The objective is not to claim that every newly registered domain is malicious. Instead, the goal is to identify potential phishing infrastructure at an early stage, before it necessarily appears in conventional malicious-domain feeds.
This creates a complementary detection layer between raw infrastructure registration and confirmed malicious intelligence.
The term Day Zero in Antiphishing refers to the project's goal of reducing the time between the emergence of suspicious infrastructure and defensive action.
It does not mean that Antiphishing can detect every zero-day attack, vulnerability, or previously unknown malware family.
The focus is narrower and practical:
Identify suspicious phishing infrastructure as early as possible and make that intelligence actionable at the network layer.
Predictive intelligence requires a different confidence model from traditional validated IOC feeds.
Domains generated by the NRD analysis pipeline are candidate indicators produced through automated heuristics. They should therefore be treated as highly suspicious infrastructure, rather than automatically interpreted as manually validated malicious IOCs.
Because the NRD pipeline prioritizes early detection, false positives are possible.
Organizations deploying predictive indicators should consider appropriate:
The NRD-derived intelligence is particularly suited to environments where early blocking of suspicious infrastructure is preferable to waiting for a domain to become a confirmed malicious IOC.
This is a deliberate trade-off:
Earlier intelligence can provide earlier protection, but earlier intelligence also carries greater uncertainty.
Antiphishing is more than a static phishing blocklist.
The project combines multiple sources and processing stages:
External Threat Feeds
│
├── Phishing indicators
│
└── Infrastructure indicators
│
▼
┌───────────────────┐
│ Intelligence │
│ Processing │
└───────────────────┘
│
├── Domain analysis
├── IP analysis
└── URL processing
│
▼
Newly Registered Domains
│
▼
Candidate Generation
│
├── Typosquatting
├── Homoglyphs
├── Keywords
└── Brand impersonation
│
▼
Suspicious Infrastructure
│
▼
Suricata Detection
│
▼
IDS / IPS Enforcement
The project also relies on external free software, open-source libraries, public intelligence sources, and community APIs.
Antiphishing's role is to combine these components into an automated intelligence and detection pipeline.
The main Suricata ruleset (antiphishing.rules) provides multiple detection layers.
Important: Whether a matching rule generates an alert or actively blocks traffic depends on how Suricata is deployed and configured, particularly whether it is operating in IDS or IPS mode.
Detection of suspicious domains during DNS inspection using:
dns.query
The native Suricata dataset contains the domain intelligence used by the DNS signature.
Detection through the TLS Server Name Indication (SNI):
tls.sni
This allows domain-based detection without decrypting HTTPS traffic.
Inspection of HTTP traffic and phishing URLs using application-layer signatures.
HTTP detection can provide more specific visibility into the requested resource when the traffic is available for inspection.
Detection of connections to known phishing infrastructure using destination IPv4 intelligence.
The main ruleset uses Suricata's dataset mechanism for this intelligence.
The main Antiphishing ruleset uses native Suricata external datasets.
phishing.lst
Domain intelligence used by the DNS and TLS dataset signatures.
The domain dataset is maintained separately from the Suricata signature file because it contains dataset values rather than Suricata signatures.
phishing_ips.lst
IPv4 indicators used by the destination-IP dataset signature.
nrd_suspicious_domains.txt
Domains generated by the NRD analysis pipeline and classified as suspicious candidates.
Important: NRD-derived domains are predictive intelligence and should not automatically be interpreted as confirmed malicious indicators.
Antiphishing is integrated with the OPNsense IDS/IPS ecosystem through:
os-intrusion-detection-content-at-antiphishing
The OPNsense integration is currently not equivalent to the full native Antiphishing ruleset.
The existing OPNsense integration reliably provides the HTTP signatures.