I’m working on a new detection layer for the open-source Antiphishing ruleset for Suricata.

The idea is to monitor active Newly Registered Domains (NRDs) and look for early indicators of phishing infrastructure.

The pipeline currently uses:

NRDs → structural analysis with dnstwist → typosquatting / homoglyph detection → high-risk keyword combinations → suspicious-domain classification → automatic inclusion in phishing.lst → Suricata DNS / TLS detection

The important distinction is that these are not simply domains imported from an external phishing feed.

The suspicious domains are identified by our own analysis pipeline. Once a domain meets the classification criteria, it is added to the ruleset and becomes available for DNS and TLS SNI detection.

We also keep the original suspicious domains in nrd_suspicious_domains.txt to provide traceability, auditing and a way to investigate potential false positives.

The goal is to reduce the gap between the registration of a potentially malicious domain and its availability as a network detection indicator.

This is still an evolving detection layer, and I’m particularly interested in feedback from people working with CTI, phishing detection, Suricata and DNS-based detection.

Project: https://github.com/julioliraup/Antiphishing

CyberSecurity #ThreatIntelligence #Suricata #Phishing #CTI #BlueTeam #OpenSource