Antiphishing: detecting newly registered phishing infrastructure before it becomes a known IOC
Source Reddit Cybersecurity
Discussion
This is an open-source project focused on early detection of phishing infrastructure by monitoring newly registered domains (NRDs) and applying structural and keyword analysis to identify suspicious domains before they become known indicators of compromise (IOCs). The detection pipeline integrates with Suricata rulesets to enable DNS and TLS detection of these suspicious domains, aiming to reduce the time gap between domain registration and network detection. The project is evolving and seeks community feedback for improvement.
r/cybersecurity (opens in a new tab)u/Limp_Durian_68500 points0 comments
I’m working on a new detection layer for the open-source Antiphishing ruleset for Suricata.
The idea is to monitor active Newly Registered Domains (NRDs) and look for early indicators of phishing infrastructure.
The pipeline currently uses:
NRDs → structural analysis with dnstwist → typosquatting / homoglyph detection → high-risk keyword combinations → suspicious-domain classification → automatic inclusion in phishing.lst → Suricata DNS / TLS detection
The important distinction is that these are not simply domains imported from an external phishing feed.
The suspicious domains are identified by our own analysis pipeline. Once a domain meets the classification criteria, it is added to the ruleset and becomes available for DNS and TLS SNI detection.
We also keep the original suspicious domains in nrd_suspicious_domains.txt to provide traceability, auditing and a way to investigate potential false positives.
The goal is to reduce the gap between the registration of a potentially malicious domain and its availability as a network detection indicator.
This is still an evolving detection layer, and I’m particularly interested in feedback from people working with CTI, phishing detection, Suricata and DNS-based detection.
Project: https://github.com/julioliraup/Antiphishing