Maltrail is a production-grade malicious traffic detection system that monitors network traffic in real-time, matching against a dynamic set of threat indicators (trails) and applying behavioral heuristics. It consists of two main components: a high-performance Rust sensor for packet capture and analysis, and a Python server for event intake, web dashboard, and API. The sensor uses libpcap for live capture or offline pcap replay, parses protocols (DNS, HTTP, TLS, QUIC), and performs trail matching and heuristic detection (port scanning, beaconing, DNS tunneling/exhaustion). Events are sent to the server via UDP or stored locally. The server provides a web UI for visualization, search, and management, supports remote logging to SIEMs (syslog, CEF, Logstash), and exposes a REST API for integration. The architecture is modular: the sensor is a multi-threaded Rust binary with lock-free metrics, memory-mapped trail stores, and fuzz-tested protocol parsers. The Python server handles configuration, trail updates from 40+ threat feeds, event logging, and the web interface. The system is designed for scalability with multi-worker capture, bounded memory heuristics, and efficient data structures (LRU caches, interned strings, hash tables). External dependencies include libpcap, SQLite, and various threat feed sources. The codebase demonstrates high craftsmanship with extensive testing (unit, integration, fuzz, parity tests between Rust and Python), CI/CD pipelines, and Docker/systemd deployment support.
hBlock is a POSIX-compliant shell script that downloads multiple ad, tracking, and malware domain blocklists from curated sources, processes them into a unified hosts file (or alternative formats like dnsmasq, unbound, adblock, Windows PowerShell), and installs it to block those domains at the system level. The core architecture is a single self-contained script (hblock) with a custom option parser, robust error handling, and support for parallel downloads, allow/deny lists, template-based output formatting, and subdomain filtering. It is not a reusable library but a complete CLI tool; however, its companion scripts (resource/alt-formats/*.sh) demonstrate a clean plugin pattern for generating multiple output formats, and the stats script (resources/stats/stats.sh) provides a reusable utility for analyzing domain lists against the Public Suffix List. The project is well-maintained, tested across multiple shells and platforms, and follows strict POSIX shell practices.
This repository is a data pipeline that aggregates and consolidates hosts files from 20+ upstream sources (adaway.org, mvps.org, someonewhocares.org, yoyo.org, URLHaus, KADhosts, hostsVN, and others) into unified blocklists for adware, malware, tracking, and optional categories (porn, gambling, fake news, social media). The core pipeline (`updateHostsFile.py`) fetches remote hosts files via HTTP, parses them, deduplicates entries, applies whitelist/blacklist filters, and generates a primary `hosts` file plus 30+ alternate permutations in `alternates/`. Each source has metadata in `update.json` (URL, license, frequency). The `makeHosts.py` script orchestrates full matrix generation of all extension combinations. Output includes stats tracking (`stats.out`, `stats.png`) and auto-generated READMEs via `updateReadme.py`. The repo includes Docker support, GitHub Actions CI (lint, test, multi-Python), CodeQL scanning, and automated dependency updates via Dependabot. Data sources are external URLs; the pipeline is idempotent and designed for scheduled runs.
This repository is a curated collection of threat intelligence indicators of compromise (IOCs) published by ESET Research. It contains structured data for hundreds of malware families and APT campaigns, including file hashes (MD5, SHA1, SHA256), network indicators (domains, IPs, URLs), host-based artifacts (registry keys, file paths, mutexes), and detection rules (YARA, Sigma, Snort). The data is organized per-threat in consistent directory structures with README.adoc documentation, MISP event JSON exports, and plain hash lists. The repository serves as a reference for threat hunters, SOC analysts, and security researchers to detect and investigate known threats. While the data is static and time-sensitive, the detection rules and structured IOC formats are directly reusable in security tools and platforms.
This repository provides a comprehensive Nginx security configuration package to block malicious bots, spam referrers, bad IPs, and vulnerability scanners. It includes curated blocklists (bad user agents, referrers, IPs, fake Googlebots), rate limiting/DDoS protection, and optional fail2ban integration. The core deliverable is a set of modular Nginx include files (bots.d/, conf.d/) and shell scripts (install-ngxblocker, setup-ngxblocker, update-ngxblocker) for automated deployment and daily updates. It also generates Google Analytics ghost spam exclusion lists and a Google Search Console disavow file. The architecture is a collection of configuration templates and deployment tooling, not a standalone application; it is designed to be included into existing Nginx server blocks. The repository is actively maintained with frequent updates to blocklists and CI testing across multiple Linux distributions.
openSquat is a CLI tool for detecting domain squatting threats including phishing, typosquatting, IDN homograph attacks, doppelgänger domains, and bitsquatting. It operates in three modes: Community (free NRD feed), Premium Feed (paid NRD feed with local Levenshtein detection), and Premium API (server-side lookalike API queries). The tool processes keywords against domain feeds using optimized Levenshtein distance with early exit, integrates with VirusTotal, Quad9 DNS, Certificate Transparency, and phishing databases, and outputs results in TXT, JSON, or CSV formats. Architecture features modular components for feed management, DNS validation, squatting detection, API client, and output handling, with parallel processing for performance.
This repository is a comprehensive library of machine-readable taxonomies (machine tags) for threat intelligence and information sharing, primarily designed for the MISP platform. It contains over 200 taxonomy definitions in a standardized JSON format, each defining a namespace with predicates and values for tagging events, attributes, and indicators. The taxonomies cover a wide range of domains including cyber incident classification, malware analysis, information handling policies (TLP, PAP, IEP), regulatory compliance (GDPR, NIS2, EU AI Act), attack modeling (kill chain, Diamond Model), and specialized areas like disinformation, AI safety, and drone classification. While the core content is data, the repository also includes a set of reusable Python tools for validation, generation, and conversion of taxonomies, as well as CI/CD pipelines and a JSON schema. The hybrid nature is evident: it is primarily a data library but with significant application-like tooling for maintaining and extending the taxonomy collection.
This repository is a curated list (awesome list) of resources related to malware persistence techniques, tools, and references across multiple platforms (Windows, Linux, macOS, Cloud, Firmware, Databases). It does not contain any executable code, application logic, or data pipelines; it is purely a collection of external links and descriptions organized into categories such as Techniques, Persistence Removal, Detection Testing, Prevention, and Collection. The repository is maintained under the 'awesome' standard with a CI workflow that runs awesome-lint to ensure formatting compliance. It serves as a reference knowledge base for cybersecurity professionals researching persistence mechanisms.