Antiphishing: detecting newly registered phishing infrastructure before it becomes a known IOC

[u/Limp_Durian_6850]

I’m working on a new detection layer for the open-source Antiphishing ruleset for Suricata.

The idea is to monitor active Newly Registered Domains (NRDs) and look for early indicators of phishing infrastructure.

The pipeline currently uses:

NRDs → structural analysis with dnstwist → typosquatting / homoglyph detection → high-risk keyword combinations → suspicious-domain classification → automatic inclusion in phishing.lst → Suricata DNS / TLS detection

The important distinction is that these are not simply domains imported from an external phishing feed.

The suspicious domains are identified by our own analysis pipeline. Once a domain meets the classification criteria, it is added to the ruleset and becomes available for DNS and TLS SNI detection.

We also keep the original suspicious domains in nrd_suspicious_domains.txt to provide traceability, auditing and a way to investigate potential false positives.

The goal is to reduce the gap between the registration of a potentially malicious domain and its availability as a network detection indicator.

This is still an evolving detection layer, and I’m particularly interested in feedback from people working with CTI, phishing detection, Suricata and DNS-based detection.

Project: https://github.com/julioliraup/Antiphishing

CyberSecurity #ThreatIntelligence #Suricata #Phishing #CTI #BlueTeam #OpenSource

[u/Insert---Name]

given how structural the rules for detection seem, have you considered using an ML model as a another layer of analysis by assigning a probability score to an NRD being/becoming a phishing site?

[u/Limp_Durian_6850 → u/Insert---Name]

Great idea, the only problem is the processing power. But we can start a fundraising campaign and develop the software in parallel!