Login

u/Limp_Durian_6850

r/blueteamsec r/cybersecurity r/PFSENSE r/secbr r/opnsense r/osinttools
Image 1 — [Project Update] The Open-Source Antiphishing CTI just hit 1,000+ active deployments. Now, we need to talk about scaling the infrastructure
Image 2 — [Project Update] The Open-Source Antiphishing CTI just hit 1,000+ active deployments. Now, we need to talk about scaling the infrastructure
▲ 29 r/opnsense

[Project Update] The Open-Source Antiphishing CTI just hit 1,000+ active deployments. Now, we need to talk about scaling the infrastructure

Hey everyone,

A couple of weeks ago, I shared the Antiphishing CTI Ruleset here - a completely free, GPLv3 predictive threat intelligence engine focused on Newly Registered Domains (NRDs) for Suricata, on OPNsense.

The community response was insane. Looking at the repo metrics, we just crossed 1,000+ active automated deployments in the last 14 days. It’s amazing to see so many of you integrating this into your perimeters.

The Architectural Challenge (Why I’m posting this):

Right now, the Python heuristic core is ingesting, deduplicating, and correlating over 1.5 Million raw threat vectors and NRDs daily. We are filtering the noise from public OSINT to generate high-fidelity, aggressive blocklists.

The problem is: the math of cloud infrastructure is catching up. Processing this volume and querying historical WHOIS/Passive DNS APIs requires serious compute power. We are starting to hit rate limits on our enrichment APIs.

The Corporate Sponsorship Open Call:

To be clear: The core ruleset is, and will always be, 100% free and open-source for homelabbers and the community. I hate paywalled security feeds.

However, I know many of you are running this in production MSSPs, SOCs, and ISPs, saving thousands of dollars on commercial threat feeds.

If your business relies on this engine, I am officially opening GitHub Sponsors tiers for Corporate Partners. This isn't a donation; it's funding for the cloud nodes and API keys that keep the intelligence flowing.

What businesses get in return:

  • Priority SLA (8h - 24h): If my aggressive heuristics block a legitimate domain (False Positive) on your client's network, you get a direct VIP queue for immediate whitelisting and rule tuning.
  • access to the maintainer (me) for specific architectural questions.
  • Direct

If your company can support the project, check out the GitHub Sponsors page here: https://github.com/sponsors/julioliraup

Thanks again to everyone testing, reporting FPs, and helping the ruleset get better. The fight against day-zero phishing continues!

u/Limp_Durian_6850 — 14 hours ago
▲ 159 r/secbr+1 crossposts

OPNsense 26.7.2 released

26.7.2_2:

  • unbound: switch AAAA-only mode from respip to block_a_wdata (contributed by Maurice Walker)
  • ui: bootgrid: classname can depend on state, accept a callback function

26.7.2:

  • system: use /var/lib/php/tmp in static pages for proper privilege separation
  • system: improve "user-config-readonly" in static pages where write_config() was denied
  • system: service widget changes based on further community feedback
  • system: support 7680 bit RSA type for certificates and authorities
  • system: add redirection capability to SSO provider
  • reporting: correctly map NetFlow indexes when there are gaps (contributed by Thomas Cheyney)
  • reporting: improve parsing in NetFlow for overlapping flow timestamps and use UTC for cleanups
  • reporting: make parsing iftop lines more robust for traffic graphs (contributed by Brendan Bank)
  • reporting: map ARC and laundry to cache memory stats (contributed by Konstantinos Spartalis)
  • reporting: stop NetFlow service before reloading configuration
  • interfaces: fix assignment of wireless devices
  • interfaces: strict description fields in new assignments page (reported by call-AX)
  • interfaces: fix typos in GIF reconfiguration script
  • interfaces: add "noclamp" flag for GIF
  • interfaces: add separate link types for IPv4 and IPv6 in overview
  • interfaces: return the proper UUID when assigning an interface (contributed by Kemoy Campbell)
  • interfaces: improve VIP page save when no subnet was posted
  • firewall: use htmlSafe() on action search value in live log (reported by call-AX)
  • firewall: group invalid rules to the end of the ruleset
  • firewall: enable virtualDOM and refactor commands on alias page
  • firewall: add "endpoint-independent" support for UDP translations (full cone NAT) in source NAT
  • firewall: fix missing well-known ports in local-port in destination NAT
  • firewall: add "max-pkt-rate" rate limiting option to firewall rules
  • firewall: add proper support for container items in search field selection, export and import data and implement it in destination NAT
  • firewall: scope get action to general settings in source NAT
  • kea: improve prefix watcher accuracy via both interface and MAC address key
  • kea: store subnet IDs inside the model so they cannot shift during config regeneration
  • kea: change dynamic pool range from prefix to range 1000-2000
  • kea: switch custom DHCP option config generation to libdhcp_flex_option library
  • openvpn: add some input validation for control characters in connection status (reported by lujiefsi)
  • backend: sanitize template filename replacements
  • backend: further restrict actions to root and wwwonly for more sensitive actions
  • backend: ensure strict templates are not reloaded via "*" wildcard
  • mvc: add some missing htmlSafe() calls for generated HTML (reported by lujiefsi)
  • mvc: create runInterfaceRegistation() and use it for immediate device registration
  • mvc: add some exception types and handle them in the base template
  • mvc: clean up a number of stale imports
  • mvc: translate backend system status messages
  • mvc: translate grid view labels
  • ui: add some more legacy_html_escape_form_data() safeguards (reported by Arpit Jain)
  • ui: add tokenize2.css in standard theme to ensure selection in opnsense-auto theme
  • ui: prevent blinking by hiding the contents while loading for opnsense-auto theme
  • ui: fix collapsed sidebar stray line and restore rail divider in opnsense-dark theme (contributed by circa1665)
  • ui: restore stacked layout for interfaces widget on narrow (contributed by circa1665)
  • ui: fix minor JavaScript bugs in dashboard widget code (contributed by Thomas Schöpf)
  • ui: do not freeze commands column on touchscreen devices
  • ui: further fixes for base templates
  • ui: fix empty legacy firewall menu container glitch
  • plugins: os-caddy 2.2.0
  • plugins: os-frr 1.54
  • plugins: os-intrusion-detection-content-at-antiphishing 1.0 (contributed by Julio Lira)
  • plugins: os-ndp-proxy-go 1.4
  • plugins: os-nrpe 1.2
  • plugins: os-theme-rebellion 1.9.6 (contributed by Team Rebellion)
  • src: pf: add missing PF_TS_CNT netlink attribute
  • src: pf: expose first rule label for states since rule number is insufficient
  • src: usb: bpfattach() before if_attach()
  • src: igc: disable PCIe ASPM to improve stability
  • src: ena: update driver version to v2.8.4
  • src: assorted minor commits from stable/15
  • src: coredump: do not assume that the number of ELF segments is consistent
  • src: sysvsem: fix a TOCTOU race in semctl()
  • src: jail: restore ktrace privileges for jailed root
  • src: ktimer: check for errors from realtimer_gettime()
  • src: kqueue: avoid enqueuing an already-enqueued knote
  • src: zfs: multiple fixes
  • src: tzdata: import 2026c
  • src: wg: check for crypto operation errors
  • src: revert "daemon: replace memchr with memrchr"
  • ports: dpinger 3.6
  • ports: hostapd / wpa_supplicant 2.12
  • ports: nss 3.126
  • ports: openldap 2.6.14
  • ports: openssh 10.4p1
  • ports: openvpn 2.7.6
  • ports: phalcon 5.18.2
  • ports: py-duckdb 1.5.5
  • ports: python 3.13.15
  • ports: unbound 1.26.0
forum.opnsense.org
u/Limp_Durian_6850 — 7 days ago
▲ 91 r/PFSENSE+3 crossposts

Antiphishing: detecting newly registered phishing infrastructure before it becomes a known IOC

I’m working on a new detection layer for the open-source Antiphishing ruleset for Suricata.

The idea is to monitor active Newly Registered Domains (NRDs) and look for early indicators of phishing infrastructure.

The pipeline currently uses:

NRDs → structural analysis with dnstwist → typosquatting / homoglyph detection → high-risk keyword combinations → suspicious-domain classification → automatic inclusion in phishing.lst → Suricata DNS / TLS detection

The important distinction is that these are not simply domains imported from an external phishing feed.

The suspicious domains are identified by our own analysis pipeline. Once a domain meets the classification criteria, it is added to the ruleset and becomes available for DNS and TLS SNI detection.

We also keep the original suspicious domains in nrd_suspicious_domains.txt to provide traceability, auditing and a way to investigate potential false positives.

The goal is to reduce the gap between the registration of a potentially malicious domain and its availability as a network detection indicator.

This is still an evolving detection layer, and I’m particularly interested in feedback from people working with CTI, phishing detection, Suricata and DNS-based detection.

Project: https://github.com/julioliraup/Antiphishing

#CyberSecurity #ThreatIntelligence #Suricata #Phishing #CTI #BlueTeam #OpenSource

u/Limp_Durian_6850 — 7 days ago
▲ 4 r/secbr

Antiphishing: Ruleset livre para a comunidade contra ataques de phishing

Quando falamos em segurança da informação, desenvolvemos um leque de possibilidades e ataques dos mais sofisticados de espionagem corporativa aos mais amadores dos estelionátos que vemos por aí. E defender disso tudo é um desafio grande para o investimento na área (que é pouco), mas vamos ao que interessa.

julioliraup.github.io
u/Limp_Durian_6850 — 1 month ago
▲ 14 r/secbr

[Código Aberto] Meu ruleset Antiphishing para Suricata agora está oficialmente no suricata-update!

Oi pessoal,

Estou animado para compartilhar que meu projeto de código aberto, julioliraup/Antiphishing, foi aceito e adicionado ao índice oficial de fontes suricata-update! Eu construí este projeto do zero para fornecer assinaturas dinâmicas de alta frequência, especificamente projetadas para mitigar vetores de ataque de phishing. O pipeline ingere indicadores de fontes comunitárias confiáveis (como PhishStats e OpenPhish) para criar regras automatizadas de TLS, DNS e HTTP (SIDs 6000000 - 6100000).

Ecossistema do Projeto:

  • O Ruleset: Atualizações automatizadas visando domínios de phishing ativos.
  • Portal de Consulta de Inteligência de Ameaças: Também mantemos um painel de controle em https://julioliraup.github.io/AT para análise de vetores em tempo real.

Guias de Implantação:

Como vários Firewalls utilizam o Suricata como IDPS (ainda bem), segue os manuais para usar a ruleset:

Repo: https://github.com/julioliraup/Antiphishing

Print (screenshot) do painel web julioliraup/Antiphishing

reddit.com
u/Limp_Durian_6850 — 1 month ago
▲ 35 r/PFSENSE+4 crossposts

Julioliraup/Antiphishing Suricata ruleset added upstream — pfSense guide available

Hello FW ADMs,

If you monitor malicious egress or ingress connections on your network edge using Suricata, julioliraup/Antiphishing is now available natively inside the upstream suricata-update ecosystem.

The ruleset provides frequently updated TLS, DNS, and HTTP signatures (SIDs 6000000 - 6100000) specifically tailored to block phishing campaigns. You can inspect the live database of tracked indicators on our companion portal: https://github.com/julioliraup/AT

Platform Integration Status:

Community Collaboration

This is a transparent, community-funded project (GPL-v3). Since phishing infrastructure cycles rapidly, the best way to support us right now is by deploying the ruleset and providing real-world feedback.

If you run into false positives, have suggestions for the rule generation script, or want to help us develop new features for the web dashboard, please open an issue or pull request on our GitHub!

GitHub: https://github.com/julioliraup/Antiphishing

u/Limp_Durian_6850 — 16 days ago
▲ 1 r/blueteamsec

[Open Source] My antiphishing Suricata ruleset is now officially in suricata-update! Looking for dashboard devs & telemetry contributors.

Hi Blue Teamers,

I'm proud to share that my open-source security project, julioliraup/Antiphishing, has been accepted and integrated into the official global suricata-update source index!

I built this pipeline from scratch to dynamically track and block active phishing infrastructure. The engine aggregates data from trusted community resources (like PhishStats and OpenPhish) to generate automated TLS, DNS, and HTTP rules (SID range 6000000 - 6100000).

Project Architecture & Navigation:

  • The Ruleset: High-frequency signature updates to stop fast-cycling phishing domains.
  • Threat Intel Lookup Portal: We host a companion web application at https://julioliraup.github.io/AT to visualize and query active threat vectors.

Deployment & Stability:

Because network security requires stability, we make sure our rules don't break your standard traffic. You can implement it safely following our verified documentation:

How You Can Help Evolve the Project 🚀

The project is fully open-source (GPL-v3). If you want to contribute, I am currently looking for:

  1. Frontend/Data Devs: To help scale and optimize the dashboard UI/UX and lookup capabilities of the /AT portal.
  2. Threat Intel Contributors: If you manage honeypots or have specialized phishing feeds, your data inputs are highly welcome.
  3. Beta Testers: Run the ruleset, share your feedback, and report any false positives via GitHub Issues.

Check out the repository, drop a star if you find it useful, and let's make phishing detection stronger together!

Repo: https://github.com/julioliraup/Antiphishing

reddit.com
u/Limp_Durian_6850 — 1 month ago
▲ 11 r/cybersecurity

[Open Source] My antiphishing Suricata ruleset is now officially in suricata-update! Looking for contributors

Hi Blue Teamers,

I'm excited to share that my open-source project, julioliraup/Antiphishing, has been accepted and added to the official suricata-update source index! I built this project from scratch to provide high-frequency, dynamic signatures specifically designed to mitigate phishing attack vectors. The pipeline ingests indicators from trusted community sources (like PhishStats and OpenPhish) to build automated TLS, DNS, and HTTP rules (SIDs 6000000 - 6100000).

Project Ecosystem:

  • The Ruleset: Automated updates targeting active phishing domains.
  • Threat Intelligence Lookup Portal: We also maintain a web companion dashboard at https://julioliraup.github.io/AT for real-time vector analysis.

Deployment Guides:

Since firewall platforms handle rule storage uniquely, please follow the dedicated instructions to prevent system configuration overrides:

Repo: https://github.com/julioliraup/Antiphishing

reddit.com
u/Limp_Durian_6850 — 1 month ago