Repository navigation
Home
Antiphishing is an open-source phishing intelligence and Suricata detection ruleset designed for network-level phishing detection.
The project combines known phishing indicators, domain intelligence and Newly Registered Domain (NRD) analysis to generate detection content for DNS, TLS, HTTP and IPv4 traffic.
Detection engine: Suricata
Threat intelligence: phishing feeds, domain analysis and NRD candidate intelligence
Detection coverage: DNS · TLS · HTTP · IPv4
Antiphishing separates threat intelligence generation from network traffic inspection.
Antiphishing generates and maintains the detection content. Suricata is the IDS/IPS engine responsible for inspecting network traffic and evaluating the rules and datasets.
DNS queries can be inspected using:
dns.query
The Antiphishing dataset allows Suricata to identify suspicious domains during DNS resolution.
TLS traffic can be inspected through the Server Name Indication (SNI):
tls.sni
This allows domain-based phishing detection without requiring HTTPS payload decryption.
Important: Antiphishing does not decrypt HTTPS traffic. TLS detection is based on information available to Suricata, such as the TLS SNI.
The ruleset also contains HTTP detection signatures.
HTTP inspection applies when the relevant HTTP traffic and application-layer information are visible to Suricata.
Detection capabilities depend on the traffic visibility and deployment mode of Suricata.
The ruleset can also detect traffic associated with known suspicious IPv4 addresses using Suricata's dataset functionality.
The IPv4 intelligence is maintained separately from the domain dataset and is evaluated against IPv4 traffic.
Conceptually:
IPv4 Traffic
↓
IPv4 address extraction
↓
IPv4 dataset
↓
Suricata
↓
Alert
The IPv4 dataset uses Suricata's IPv4 dataset type and load mechanism, allowing the associated address intelligence to be distributed with the ruleset.
IPv4 detection identifies traffic involving addresses present in the dataset. It does not, by itself, establish that every service or resource hosted at an address is malicious.
Antiphishing combines multiple sources and techniques to improve phishing detection coverage.
Known phishing indicators can be obtained from external threat intelligence feeds and processed into Suricata detection content.
Domain characteristics can be analyzed to identify suspicious infrastructure and potential impersonation attempts.
Newly Registered Domains (NRD) are monitored to identify domains that may represent emerging phishing infrastructure.
NRD analysis is a candidate-generation mechanism, not a definitive malicious-domain verdict.
The analysis can consider signals such as:
- Typosquatting
- Homoglyphs
- Suspicious keywords
- Domain similarity
- Other characteristics associated with potential phishing infrastructure
Domains that meet the defined criteria are classified as:
Suspicious NRD Candidates
These candidates are not automatically considered confirmed malicious domains or Indicators of Compromise (IOCs).
The purpose of NRD intelligence is to surface potentially relevant emerging infrastructure for further analysis and validation.
The Antiphishing distribution contains the detection rules and the datasets required by the ruleset.
The ruleset contains signatures covering HTTP traffic as well as dataset-backed DNS, TLS and IPv4 detection.
The DNS and TLS domain rules use the phishing.lst dataset. IPv4 detection uses the corresponding IPv4 dataset distributed with the ruleset.
phishing.lst contains phishing domain intelligence used by the dataset-backed DNS and TLS rules.
The dataset is loaded directly by the rules using Suricata's load mechanism.
Conceptually:
antiphishing.rules
+
phishing.lst
↓
Suricata
This allows the ruleset to distribute its associated dataset together with the rules instead of requiring a separate dataset declaration in suricata.yaml.
The IPv4 detection rules use a dedicated IPv4 dataset containing suspicious IP addresses.
Conceptually:
IPv4 Dataset
↓
dataset:isset
↓
Suricata IPv4 traffic
↓
Detection
The IPv4 dataset is loaded directly by the associated rule using Suricata's load mechanism.
This keeps IP-based intelligence distributed with the ruleset and avoids requiring a separate manual dataset declaration when the deployment supports the bundled dataset layout.
The distribution also provides:
antiphishing.rules.md5
for integrity verification.
The complete distribution is available as:
https://github.com/julioliraup/Antiphishing/raw/refs/heads/main/antiphishing.tar.gz
The archive contains the files required by the ruleset.
https://github.com/julioliraup/Antiphishing/raw/refs/heads/main/antiphishing.rules
When installing the ruleset, make sure that the associated datasets are also available when using the dataset-backed DNS, TLS and IPv4 rules.
Antiphishing continuously generates updated detection content as new intelligence becomes available.
The process responsible for generating the ruleset and the process responsible for loading it into a running Suricata instance are separate.
Threat Intelligence
↓
Antiphishing Update Process
↓
antiphishing.rules
phishing.lst
IPv4 dataset
↓
Deployment Platform
↓
Suricata
Updating the files on disk does not necessarily replace a dataset that has already been loaded into a running Suricata process.
Depending on the deployment environment and Suricata reload mechanism, a full Suricata restart may be required for updated datasets to be loaded.
See the platform-specific integration guides for details.
Antiphishing can be deployed in different environments running Suricata.
Configuration Ruleset on GNU/Linux
Configuration Ruleset on pfSense
Quick Guide: Installing Antiphishing on OPNsense
Configuration: Antiphishing Ruleset on IDSTower
Configuration Ruleset on ClearOS
Configuring the Antiphishing Ruleset on IPFire
After installation, verify that Suricata accepts the ruleset configuration:
suricata -T -c /path/to/suricata.yamlConfiguration validation alone does not guarantee that a dataset contains the expected indicators.
Where possible, verify that:
-
antiphishing.rulesis loaded. - The required datasets are available at the expected paths.
- The datasets are successfully loaded.
- The expected SIDs are active.
- Suricata generates an alert when a controlled test indicator is queried or contacted.
Always perform testing in an authorized environment.
The Antiphishing project provides a public API for querying phishing intelligence and detection information.
See:
API capacity is subject to infrastructure and provider rate limits.
Have you identified a phishing domain or another relevant threat vector?
You can submit intelligence to the project:
Submitted intelligence can contribute to future detection coverage after analysis and validation.
Antiphishing is an open-source project and contributions are welcome.
You can contribute through:
- Detection engineering
- Threat intelligence
- False-positive reports
- New phishing vectors
- Documentation
- Code
- Testing
- Integration guides
See:
Antiphishing is maintained as open-source security infrastructure.
Keeping the project continuously updated requires external services and infrastructure, including:
- Threat intelligence APIs
- Domain analysis services
- NRD processing
- Hosting
- Public API infrastructure
- Dashboard infrastructure
- Research and development
- Continuous maintenance
As the public intelligence platform grows, API rate limits and infrastructure capacity can limit the amount of intelligence that can be processed and exposed.
CTI API Capacity
↓
More Domain Analysis
↓
More Intelligence
↓
More Detection Content
↓
Better Open-Source Protection
If you want to help keep the project running and expand its capabilities:
[ DONATE - DASHBOARD VECTORS - CONTRIBUTING - SUBMIT A VECTOR - REST API CTI ]