stamparm/maltrail
Malicious traffic detection system
Build with Backblaze B2
SDKs, agent skills, IDE extensions, and reference pipelines from Backblaze Labs. All open source.
Loading star history...
Where it stands
Rank, growth pace and release cadence relative to everything GStars tracks.
4 releases in the last 90 days, the latest 27 days ago, with 8 contributors on GitHub.
Peaked at #53 in the weekly ranking the week of Oct 19, its best in the past year.
Use Cases & Benefits
- Detects malicious network traffic by monitoring domains, URLs, IPs, and HTTP headers using blacklists and heuristic analysis.
- Combines extensive public blacklists with heuristic detection to identify both known and unknown threats in real-time network traffic.
- Use for monitoring enterprise network traffic to detect and log suspicious or malicious activity for security teams.
- Use for integrating with fail2ban or ipset to automate blocking of attacker IPs based on detected malicious events.
- Use for running a honeypot sensor to capture and analyze malware-related network trails and suspicious connections.
Should you depend on it?
License terms, project hygiene and risks, from GitHub metadata and GStars' snapshots.
License
MIT
Permissive: commercial use, modification and redistribution are allowed with attribution.
Community files
- README: present
- Contributing guide: present
- Code of conduct: present
Watch-outs
No watch-outs from GStars' checks.
General guidance from repository metadata, not legal advice. How we score
From the README
Maltrail is a malicious traffic detection system, utilizing publicly available (black)lists containing malicious and/or generally suspicious trails, along with static trails compiled from various AV reports and custom user defined lists, where trail can be anything from domain name (e.g.
zvpprsensinaix.comfor Banjori malware), URL (e.g.hXXp://109.162.38.120/harsh02.exefor known malicious executable), IP address (e.g.185.130.5.231for known attacker) or HTTP User-Agent header value (e.g.sqlmapfor automatic SQL injection and database takeover tool). Also, it uses (optional) advanced heuristic mechanisms that can help in discovery of unknown threats (e.g. new malware).
Daily snapshots
Stars gained per day, and how forks and open issues moved, from GStars' daily snapshots
Forks
1.3K+6
Open issues
5-84
Compared with peers in Security
Fastest-growing repositories GStars tracks in this cohort for the week of Nov 8, by 7-day star growth
| Repository | Stars | +7d | Health | Last release |
|---|---|---|---|---|
| cloudflare/security-audit-skill | 69.3K | +10.7K | 75 | — |
| vxcontrol/pentagi | 33.9K | +719 | 75 | 36 days ago |
| GyulyVGC/sniffnet | 42.3K | +422 | 75 | 111 days ago |
| soxoj/maigret | 39.9K | +332 | 60 | 87 days ago |
| Asymptote-Labs/agent-beacon | 3.4K | +315 | 75 | 1 day ago |
| stamparm/maltrail | 8.7K | — | 75 | 27 days ago |
| Category median | 39.9K | +422 | 75 | — |
Discover Repositories
Search across tracked repositories by name or description