README.md

   1 # Phishing URL Blocklist
   2
   3 A blocklist of phishing websites, based on the [PhishTank](https://www.phishtank.com/) and [OpenPhish](https://openphish.com/) lists. Blocklist is updated twice a day.
   4
   5 There are multiple formats available, refer to the appropriate section according to the program used:
   6
   7 - uBlock Origin (uBO) -> [URL-based](#url-based) section (recommended)
   8 - Pi-hole -> [Domain-based](#domain-based) or [Hosts-based](#hosts-based) section
   9 - AdGuard Home -> [Domain-based (AdGuard Home)](#domain-based-adguard-home) or [Hosts-based](#hosts-based) section
  10 - AdGuard browser extension -> [URL-based (AdGuard)](#url-based-adguard)
  11 - Vivaldi -> [URL-based (Vivaldi)](#url-based-vivaldi)
  12 - [Hosts](#hosts-based)
  13 - [Dnsmasq](#dnsmasq)
  14 - BIND -> BIND [zone](#bind) or [RPZ](#response-policy-zone)
  15 - [Unbound](#unbound)
  16 - [dnscrypt-proxy](#dnscrypt-proxy)
  17 - Internet Explorer -> [Tracking Protection List (IE)](#tracking-protection-list-ie)
  18 - [Snort2](#snort2)
  19 - [Snort3](#snort3)
  20 - [Suricata](#suricata)
  21
  22 Not sure which format to choose? See [Compatibility](https://gitlab.com/curben/urlhaus-filter/wikis/compatibility) page.
  23
  24 Check out my other filters:
  25
  26 - [urlhaus-filter](https://gitlab.com/curben/urlhaus-filter)
  27 - [pup-filter](https://gitlab.com/curben/pup-filter)
  28 - [tracking-filter](https://gitlab.com/curben/tracking-filter)
  29
  30 ## URL-based
  31
  32 Import the following URL into uBO to subscribe:
  33
  34 - https://curben.gitlab.io/malware-filter/phishing-filter.txt
  35
  36 _included by default in uBO >=[1.39.0](https://github.com/gorhill/uBlock/releases/tag/1.39.0); to enable, head to "Filter lists" tab, expand "Malware domains" section and tick "Phishing URL Blocklist"._
  37
  38 <details>
  39 <summary>Mirrors</summary>
  40
  41 - https://cdn.statically.io/gl/curben/phishing-filter/master/dist/phishing-filter.txt
  42 - https://glcdn.githack.com/curben/phishing-filter/raw/master/dist/phishing-filter.txt
  43 - https://raw.githubusercontent.com/curbengh/phishing-filter/master/dist/phishing-filter.txt
  44 - https://cdn.statically.io/gh/curbengh/phishing-filter/master/dist/phishing-filter.txt
  45 - https://gitcdn.xyz/repo/curbengh/phishing-filter/master/dist/phishing-filter.txt
  46 - https://cdn.jsdelivr.net/gh/curbengh/phishing-filter/dist/phishing-filter.txt
  47
  48 </details>
  49
  50 **AdGuard Home** users should use [this blocklist](#domain-based-adguard-home).
  51
  52 ## URL-based (AdGuard)
  53
  54 Import the following URL into AdGuard browser extension to subscribe:
  55
  56 - https://curben.gitlab.io/malware-filter/phishing-filter-ag.txt
  57
  58 <details>
  59 <summary>Mirrors</summary>
  60
  61 - https://cdn.statically.io/gl/curben/phishing-filter/master/dist/phishing-filter-ag.txt
  62 - https://glcdn.githack.com/curben/phishing-filter/raw/master/dist/phishing-filter-ag.txt
  63 - https://raw.githubusercontent.com/curbengh/phishing-filter/master/dist/phishing-filter-ag.txt
  64 - https://cdn.statically.io/gh/curbengh/phishing-filter/master/dist/phishing-filter-ag.txt
  65 - https://gitcdn.xyz/repo/curbengh/phishing-filter/master/dist/phishing-filter-ag.txt
  66 - https://cdn.jsdelivr.net/gh/curbengh/phishing-filter/dist/phishing-filter-ag.txt
  67
  68 </details>
  69
  70 ## URL-based (Vivaldi)
  71
  72 _Requires Vivaldi Desktop/Android 3.3+, blocking level must be at least "Block Trackers"_
  73
  74 Import the following URL into Vivaldi's **Tracker Blocking Sources** to subscribe:
  75
  76 - https://curben.gitlab.io/malware-filter/phishing-filter-vivaldi.txt
  77
  78 <details>
  79 <summary>Mirrors</summary>
  80
  81 - https://cdn.statically.io/gl/curben/phishing-filter/master/dist/phishing-filter-vivaldi.txt
  82 - https://glcdn.githack.com/curben/phishing-filter/raw/master/dist/phishing-filter-vivaldi.txt
  83 - https://raw.githubusercontent.com/curbengh/phishing-filter/master/dist/phishing-filter-vivaldi.txt
  84 - https://cdn.statically.io/gh/curbengh/phishing-filter/master/dist/phishing-filter-vivaldi.txt
  85 - https://gitcdn.xyz/repo/curbengh/phishing-filter/master/dist/phishing-filter-vivaldi.txt
  86 - https://cdn.jsdelivr.net/gh/curbengh/phishing-filter/dist/phishing-filter-vivaldi.txt
  87
  88 </details>
  89
  90 ## Domain-based
  91
  92 This blocklist includes domains and IP addresses.
  93
  94 - https://curben.gitlab.io/malware-filter/phishing-filter-domains.txt
  95
  96 <details>
  97 <summary>Mirrors</summary>
  98
  99 - https://cdn.statically.io/gl/curben/phishing-filter/master/dist/phishing-filter-domains.txt
 100 - https://glcdn.githack.com/curben/phishing-filter/raw/master/dist/phishing-filter-domains.txt
 101 - https://raw.githubusercontent.com/curbengh/phishing-filter/master/dist/phishing-filter-domains.txt
 102 - https://cdn.statically.io/gh/curbengh/phishing-filter/master/dist/phishing-filter-domains.txt
 103 - https://gitcdn.xyz/repo/curbengh/phishing-filter/master/dist/phishing-filter-domains.txt
 104 - https://cdn.jsdelivr.net/gh/curbengh/phishing-filter/dist/phishing-filter-domains.txt
 105
 106 </details>
 107
 108 ## Domain-based (AdGuard Home)
 109
 110 This AdGuard Home-compatible blocklist includes domains and IP addresses.
 111
 112 - https://curben.gitlab.io/malware-filter/phishing-filter-agh.txt
 113
 114 <details>
 115 <summary>Mirrors</summary>
 116
 117 - https://cdn.statically.io/gl/curben/phishing-filter/master/dist/phishing-filter-agh.txt
 118 - https://glcdn.githack.com/curben/phishing-filter/raw/master/dist/phishing-filter-agh.txt
 119 - https://raw.githubusercontent.com/curbengh/phishing-filter/master/dist/phishing-filter-agh.txt
 120 - https://cdn.statically.io/gh/curbengh/phishing-filter/master/dist/phishing-filter-agh.txt
 121 - https://gitcdn.xyz/repo/curbengh/phishing-filter/master/dist/phishing-filter-agh.txt
 122 - https://cdn.jsdelivr.net/gh/curbengh/phishing-filter/phishing-filter-agh.txt
 123
 124 </details>
 125
 126 ## Hosts-based
 127
 128 This blocklist includes domains only.
 129
 130 - https://curben.gitlab.io/malware-filter/phishing-filter-hosts.txt
 131
 132 <details>
 133 <summary>Mirrors</summary>
 134
 135 - https://cdn.statically.io/gl/curben/phishing-filter/master/dist/phishing-filter-hosts.txt
 136 - https://glcdn.githack.com/curben/phishing-filter/raw/master/dist/phishing-filter-hosts.txt
 137 - https://raw.githubusercontent.com/curbengh/phishing-filter/master/dist/phishing-filter-hosts.txt
 138 - https://cdn.statically.io/gh/curbengh/phishing-filter/master/dist/phishing-filter-hosts.txt
 139 - https://gitcdn.xyz/repo/curbengh/phishing-filter/master/dist/phishing-filter-hosts.txt
 140 - https://cdn.jsdelivr.net/gh/curbengh/phishing-filter/dist/phishing-filter-hosts.txt
 141
 142 </details>
 143
 144 ## Dnsmasq
 145
 146 This blocklist includes domains only.
 147
 148 ### Install
 149
 150 ```
 151 # Create a new folder to store the blocklist
 152 mkdir -p /usr/local/etc/dnsmasq/
 153
 154 # Create a new cron job for daily update
 155 printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/phishing-filter-dnsmasq.conf" -o "/usr/local/etc/dnsmasq/phishing-filter-dnsmasq.conf"\n' > /etc/cron.daily/phishing-filter
 156
 157 # cron job requires execution permission
 158 chmod 755 /etc/cron.daily/phishing-filter
 159
 160 # Configure dnsmasq to use the blocklist
 161 printf "\nconf-file=/usr/local/etc/dnsmasq/phishing-filter-dnsmasq.conf\n" >> /etc/dnsmasq.conf
 162 ```
 163
 164 - https://curben.gitlab.io/malware-filter/phishing-filter-dnsmasq.conf
 165
 166 <details>
 167 <summary>Mirrors</summary>
 168
 169 - https://cdn.statically.io/gl/curben/phishing-filter/master/dist/phishing-filter-dnsmasq.conf
 170 - https://glcdn.githack.com/curben/phishing-filter/raw/master/dist/phishing-filter-dnsmasq.conf
 171 - https://raw.githubusercontent.com/curbengh/phishing-filter/master/dist/phishing-filter-dnsmasq.conf
 172 - https://cdn.statically.io/gh/curbengh/phishing-filter/master/dist/phishing-filter-dnsmasq.conf
 173 - https://gitcdn.xyz/repo/curbengh/phishing-filter/master/dist/phishing-filter-dnsmasq.conf
 174 - https://cdn.jsdelivr.net/gh/curbengh/phishing-filter/dist/phishing-filter-dnsmasq.conf
 175
 176 </details>
 177
 178 ## BIND
 179
 180 This blocklist includes domains only.
 181
 182 ### Install
 183
 184 ```
 185 # Create a new folder to store the blocklist
 186 mkdir -p /usr/local/etc/bind/
 187
 188 # Create a new cron job for daily update
 189 printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/phishing-filter-bind.conf" -o "/usr/local/etc/bind/phishing-filter-bind.conf"\n' > /etc/cron.daily/phishing-filter
 190
 191 # cron job requires execution permission
 192 chmod 755 /etc/cron.daily/phishing-filter
 193
 194 # Configure BIND to use the blocklist
 195 printf '\ninclude "/usr/local/etc/bind/phishing-filter-bind.conf";\n' >> /etc/bind/named.conf
 196 ```
 197
 198 Add this to "/etc/bind/null.zone.file" (skip this step if the file already exists):
 199
 200 ```
 201 $TTL    86400   ; one day
 202 @       IN      SOA     ns.nullzone.loc. ns.nullzone.loc. (
 203                2017102203
 204                     28800
 205                      7200
 206                    864000
 207                     86400 )
 208                 NS      ns.nullzone.loc.
 209                 A       0.0.0.0
 210 @       IN      A       0.0.0.0
 211 *       IN      A       0.0.0.0
 212 ```
 213
 214 Zone file is derived from [here](https://github.com/tomzuu/blacklist-named/blob/master/null.zone.file).
 215
 216 - https://curben.gitlab.io/malware-filter/phishing-filter-bind.conf
 217
 218 <details>
 219 <summary>Mirrors</summary>
 220
 221 - https://cdn.statically.io/gl/curben/phishing-filter/master/dist/phishing-filter-bind.conf
 222 - https://glcdn.githack.com/curben/phishing-filter/raw/master/dist/phishing-filter-bind.conf
 223 - https://raw.githubusercontent.com/curbengh/phishing-filter/master/dist/phishing-filter-bind.conf
 224 - https://cdn.statically.io/gh/curbengh/phishing-filter/master/dist/phishing-filter-bind.conf
 225 - https://gitcdn.xyz/repo/curbengh/phishing-filter/master/dist/phishing-filter-bind.conf
 226 - https://cdn.jsdelivr.net/gh/curbengh/phishing-filter/dist/phishing-filter-bind.conf
 227
 228 </details>
 229
 230 ## Response Policy Zone
 231
 232 This blocklist includes domains only.
 233
 234 - https://curben.gitlab.io/malware-filter/phishing-filter-rpz.conf
 235
 236 <details>
 237 <summary>Mirrors</summary>
 238
 239 - https://cdn.statically.io/gl/curben/phishing-filter/master/dist/phishing-filter-rpz.conf
 240 - https://glcdn.githack.com/curben/phishing-filter/raw/master/dist/phishing-filter-rpz.conf
 241 - https://raw.githubusercontent.com/curbengh/phishing-filter/master/dist/phishing-filter-rpz.conf
 242 - https://cdn.statically.io/gh/curbengh/phishing-filter/master/dist/phishing-filter-rpz.conf
 243 - https://gitcdn.xyz/repo/curbengh/phishing-filter/master/dist/phishing-filter-rpz.conf
 244 - https://cdn.jsdelivr.net/gh/curbengh/phishing-filter/dist/phishing-filter-rpz.conf
 245
 246 </details>
 247
 248 ## Unbound
 249
 250 This blocklist includes domains only.
 251
 252 ### Install
 253
 254 ```
 255 # Create a new folder to store the blocklist
 256 mkdir -p /usr/local/etc/unbound/
 257
 258 # Create a new cron job for daily update
 259 printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/phishing-filter-unbound.conf" -o "/usr/local/etc/unbound/phishing-filter-unbound.conf"\n' > /etc/cron.daily/phishing-filter
 260
 261 # cron job requires execution permission
 262 chmod 755 /etc/cron.daily/phishing-filter
 263
 264 # Configure Unbound to use the blocklist
 265 printf '\n  include: "/usr/local/etc/unbound/phishing-filter-unbound.conf"\n' >> /etc/unbound/unbound.conf
 266 ```
 267
 268 - https://curben.gitlab.io/malware-filter/phishing-filter-unbound.conf
 269
 270 <details>
 271 <summary>Mirrors</summary>
 272
 273 - https://cdn.statically.io/gl/curben/phishing-filter/master/dist/phishing-filter-unbound.conf
 274 - https://glcdn.githack.com/curben/phishing-filter/raw/master/dist/phishing-filter-unbound.conf
 275 - https://raw.githubusercontent.com/curbengh/phishing-filter/master/dist/phishing-filter-unbound.conf
 276 - https://cdn.statically.io/gh/curbengh/phishing-filter/master/dist/phishing-filter-unbound.conf
 277 - https://gitcdn.xyz/repo/curbengh/phishing-filter/master/dist/phishing-filter-unbound.conf
 278 - https://cdn.jsdelivr.net/gh/curbengh/phishing-filter/dist/phishing-filter-unbound.conf
 279
 280 </details>
 281
 282 ## dnscrypt-proxy
 283
 284 ### Install
 285
 286 ```
 287 # Create a new folder to store the blocklist
 288 mkdir -p /etc/dnscrypt-proxy/
 289
 290 # Create a new cron job for daily update
 291 printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/phishing-filter-dnscrypt-blocked-names.txt" -o "/etc/dnscrypt-proxy/phishing-filter-dnscrypt-blocked-names.txt"\n' > /etc/cron.daily/phishing-filter
 292 printf '\ncurl -L "https://curben.gitlab.io/malware-filter/phishing-filter-dnscrypt-blocked-ips.txt" -o "/etc/dnscrypt-proxy/phishing-filter-dnscrypt-blocked-ips.txt"\n' >> /etc/cron.daily/phishing-filter
 293
 294 # cron job requires execution permission
 295 chmod 755 /etc/cron.daily/phishing-filter
 296 ```
 297
 298 Configure dnscrypt-proxy to use the blocklist:
 299
 300 ``` diff
 301 [blocked_names]
 302 +  blocked_names_file = '/etc/dnscrypt-proxy/phishing-filter-dnscrypt-blocked-names.txt'
 303
 304 [blocked_ips]
 305 +  blocked_ips_file = '/etc/dnscrypt-proxy/phishing-filter-dnscrypt-blocked-ips.txt'
 306 ```
 307
 308 - https://curben.gitlab.io/malware-filter/phishing-filter-dnscrypt-blocked-names.txt
 309 - https://curben.gitlab.io/malware-filter/phishing-filter-dnscrypt-blocked-ips.txt
 310
 311 <details>
 312 <summary>Mirrors</summary>
 313
 314 - https://cdn.statically.io/gl/curben/phishing-filter/master/dist/phishing-filter-dnscrypt-blocked-names.txt
 315 - https://glcdn.githack.com/curben/phishing-filter/raw/master/dist/phishing-filter-dnscrypt-blocked-names.txt
 316 - https://raw.githubusercontent.com/curbengh/phishing-filter/master/dist/phishing-filter-dnscrypt-blocked-names.txt
 317 - https://cdn.statically.io/gh/curbengh/phishing-filter/master/dist/phishing-filter-dnscrypt-blocked-names.txt
 318 - https://gitcdn.xyz/repo/curbengh/phishing-filter/master/dist/phishing-filter-dnscrypt-blocked-names.txt
 319 - https://cdn.jsdelivr.net/gh/curbengh/phishing-filter/dist/phishing-filter-dnscrypt-blocked-names.txt
 320
 321 - https://cdn.statically.io/gl/curben/phishing-filter/master/dist/phishing-filter-dnscrypt-blocked-ips.txt
 322 - https://glcdn.githack.com/curben/phishing-filter/raw/master/dist/phishing-filter-dnscrypt-blocked-ips.txt
 323 - https://raw.githubusercontent.com/curbengh/phishing-filter/master/dist/phishing-filter-dnscrypt-blocked-ips.txt
 324 - https://cdn.statically.io/gh/curbengh/phishing-filter/master/dist/phishing-filter-dnscrypt-blocked-ips.txt
 325 - https://gitcdn.xyz/repo/curbengh/phishing-filter/master/dist/phishing-filter-dnscrypt-blocked-ips.txt
 326 - https://cdn.jsdelivr.net/gh/curbengh/phishing-filter/dist/phishing-filter-dnscrypt-blocked-ips.txt
 327 </details>
 328
 329 ## Tracking Protection List (IE)
 330
 331 This blocklist includes domains only.
 332
 333 - https://curben.gitlab.io/malware-filter/phishing-filter.tpl
 334
 335 <details>
 336 <summary>Mirrors</summary>
 337
 338 - https://cdn.statically.io/gl/curben/phishing-filter/master/dist/phishing-filter.tpl
 339 - https://glcdn.githack.com/curben/phishing-filter/raw/master/dist/phishing-filter.tpl
 340 - https://raw.githubusercontent.com/curbengh/phishing-filter/master/dist/phishing-filter.tpl
 341 - https://cdn.statically.io/gh/curbengh/phishing-filter/master/dist/phishing-filter.tpl
 342 - https://gitcdn.xyz/repo/curbengh/phishing-filter/master/dist/phishing-filter.tpl
 343 - https://cdn.jsdelivr.net/gh/curbengh/phishing-filter/dist/phishing-filter.tpl
 344
 345 </details>
 346
 347 ## Snort2
 348
 349 This ruleset includes online URLs only. Not compatible with [Snort3](#snort3).
 350
 351 ### Install
 352
 353 ```
 354 # Download ruleset
 355 curl -L "https://curben.gitlab.io/malware-filter/phishing-filter-snort2.rules" -o "/etc/snort/rules/phishing-filter-snort2.rules"
 356
 357 # Create a new cron job for daily update
 358 printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/phishing-filter-snort2.rules" -o "/etc/snort/rules/phishing-filter-snort2.rules"\n' > /etc/cron.daily/phishing-filter
 359
 360 # cron job requires execution permission
 361 chmod 755 /etc/cron.daily/phishing-filter
 362
 363 # Configure Snort to use the ruleset
 364 printf "\ninclude \$RULE_PATH/phishing-filter-snort2.rules\n" >> /etc/snort/snort.conf
 365 ```
 366
 367 - https://curben.gitlab.io/malware-filter/phishing-filter-snort2.rules
 368
 369 <details>
 370 <summary>Mirrors</summary>
 371
 372 - https://cdn.statically.io/gl/curben/phishing-filter/master/dist/phishing-filter-snort2.rules
 373 - https://glcdn.githack.com/curben/phishing-filter/raw/master/dist/phishing-filter-snort2.rules
 374 - https://raw.githubusercontent.com/curbengh/phishing-filter/master/dist/phishing-filter-snort2.rules
 375 - https://cdn.statically.io/gh/curbengh/phishing-filter/master/dist/phishing-filter-snort2.rules
 376 - https://gitcdn.xyz/repo/curbengh/phishing-filter/master/dist/phishing-filter-snort2.rules
 377 - https://cdn.jsdelivr.net/gh/curbengh/phishing-filter/dist/phishing-filter-snort2.rules
 378
 379 </details>
 380
 381 ## Snort3
 382
 383 This ruleset includes online URLs only. Not compatible with [Snort2](#snort2).
 384
 385 ### Install
 386
 387 ```
 388 # Download ruleset
 389 curl -L "https://curben.gitlab.io/malware-filter/phishing-filter-snort3.rules" -o "/etc/snort/rules/phishing-filter-snort3.rules"
 390
 391 # Create a new cron job for daily update
 392 printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/phishing-filter-snort3.rules" -o "/etc/snort/rules/phishing-filter-snort3.rules"\n' > /etc/cron.daily/phishing-filter
 393
 394 # cron job requires execution permission
 395 chmod 755 /etc/cron.daily/phishing-filter
 396 ```
 397
 398 Configure Snort to use the ruleset:
 399
 400 ``` diff
 401 # /etc/snort/snort.lua
 402 ips =
 403 {
 404   variables = default_variables,
 405 +  include = 'rules/phishing-filter-snort3.rules'
 406 }
 407 ```
 408
 409 - https://curben.gitlab.io/malware-filter/phishing-filter-snort3.rules
 410
 411 <details>
 412 <summary>Mirrors</summary>
 413
 414 - https://cdn.statically.io/gl/curben/phishing-filter/master/dist/phishing-filter-snort3.rules
 415 - https://glcdn.githack.com/curben/phishing-filter/raw/master/dist/phishing-filter-snort3.rules
 416 - https://raw.githubusercontent.com/curbengh/phishing-filter/master/dist/phishing-filter-snort3.rules
 417 - https://cdn.statically.io/gh/curbengh/phishing-filter/master/dist/phishing-filter-snort3.rules
 418 - https://gitcdn.xyz/repo/curbengh/phishing-filter/master/dist/phishing-filter-snort3.rules
 419 - https://cdn.jsdelivr.net/gh/curbengh/phishing-filter/dist/phishing-filter-snort3.rules
 420
 421 </details>
 422
 423 ## Suricata
 424
 425 This ruleset includes online URLs only.
 426
 427 ### Install
 428
 429 ```
 430 # Download ruleset
 431 curl -L "https://curben.gitlab.io/malware-filter/phishing-filter-suricata.rules" -o "/etc/suricata/rules/phishing-filter-suricata.rules"
 432
 433 # Create a new cron job for daily update
 434 printf '#!/bin/sh\ncurl -L "https://curben.gitlab.io/malware-filter/phishing-filter-suricata.rules" -o "/etc/suricata/rules/phishing-filter-suricata.rules"\n' > /etc/cron.daily/phishing-filter
 435
 436 # cron job requires execution permission
 437 chmod 755 /etc/cron.daily/phishing-filter
 438 ```
 439
 440 Configure Suricata to use the ruleset:
 441
 442 ``` diff
 443 # /etc/suricata/suricata.yaml
 444 rule-files:
 445   - local.rules
 446 +  - phishing-filter-suricata.rules
 447 ```
 448
 449 - https://curben.gitlab.io/malware-filter/phishing-filter-suricata.rules
 450
 451 <details>
 452 <summary>Mirrors</summary>
 453
 454 - https://cdn.statically.io/gl/curben/phishing-filter/master/dist/phishing-filter-suricata.rules
 455 - https://glcdn.githack.com/curben/phishing-filter/raw/master/dist/phishing-filter-suricata.rules
 456 - https://raw.githubusercontent.com/curbengh/phishing-filter/master/dist/phishing-filter-suricata.rules
 457 - https://cdn.statically.io/gh/curbengh/phishing-filter/master/dist/phishing-filter-suricata.rules
 458 - https://gitcdn.xyz/repo/curbengh/phishing-filter/master/dist/phishing-filter-suricata.rules
 459 - https://cdn.jsdelivr.net/gh/curbengh/phishing-filter/dist/phishing-filter-suricata.rules
 460
 461 </details>
 462
 463 ## Issues
 464
 465 This blocklist operates by blocking the **whole** website, instead of specific webpages; exceptions are made on popular websites (e.g. `https://docs.google.com/`), in which webpages are specified instead (e.g. `https://docs.google.com/phishing-page`). Phishing webpages are only listed in [URL-based](#url-based) filter, popular websites are excluded from other filters.
 466
 467 *Popular* websites are as listed in the [Umbrella Popularity List](https://s3-us-west-1.amazonaws.com/umbrella-static/index.html) (top 1M domains + subdomains), [Tranco List](https://tranco-list.eu/) (top 1M domains) and this [custom list](src/exclude.txt).
 468
 469 If you wish to exclude certain website(s) that you believe is sufficiently well-known, please create an [issue](https://gitlab.com/curben/phishing-filter/issues) or [merge request](https://gitlab.com/curben/phishing-filter/merge_requests).
 470
 471 This blocklist **only** accepts new phishing URLs from [PhishTank](https://www.phishtank.com/) and [OpenPhish](https://openphish.com/).
 472
 473 Please report new phishing URL to [PhishTank](https://www.phishtank.com/add_web_phish.php) or [OpenPhish](https://openphish.com/faq.html).
 474
 475 ## Cloning
 476
 477 Since the filter is updated frequently, cloning the repo would become slower over time as the revision grows.
 478
 479 Use shallow clone to get the recent revisions only. Getting the last five revisions should be sufficient for a valid MR.
 480
 481 `git clone --depth 5 https://gitlab.com/curben/phishing-filter.git`
 482
 483 ## License
 484
 485 [src/](src/): [CC0](LICENSE.md)
 486
 487 [dist/](dist/): [CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/)
 488
 489 [badge.sh](src/badge.sh) & [.gitlab/](.gitlab/) contain badges that are licensed by [Shields.io](https://shields.io) under [CC0 1.0](LICENSE.md)
 490
 491 [PhishTank](https://www.phishtank.com/): Available [free of charge](https://www.phishtank.com/faq.php#isitoktousetheapifor) by Cisco for commercial and non-commercial use.
 492
 493 _PhishTank is either trademark or registered trademark of Cisco Systems, Inc._
 494
 495 [OpenPhish](https://openphish.com/): Available [free of charge](https://openphish.com/terms.html) by OpenPhish
 496
 497 [Tranco List](https://tranco-list.eu/): MIT License
 498
 499 [Umbrella Popularity List](https://s3-us-west-1.amazonaws.com/umbrella-static/index.html): Available free of charge by Cisco Umbrella
 500
 501 [csvquote](https://github.com/dbro/csvquote): [MIT License](https://choosealicense.com/licenses/mit/)
 502
 503 This repository is not endorsed by PhishTank/OpenDNS and OpenPhish.