Thank you for your interest in contributing to the Antiphishing project! We welcome community contributions to help keep this Suricata ruleset updated and effective against malicious threats.
Please review the following guidelines to ensure a smooth contribution process.
This project strictly follows the PEP 8 style guide for Python code. Before submitting any Python script modifications, please ensure your code complies with the following:
- Naming: Use
snake_casefor all function and variable names (e.g.,fetch_phishing_urls). - Structure: Keep core logic wrapped inside modular functions and maintain the execution flow within the
main()function block. - Formatting: Use 4 spaces per indentation level. Ensure there are exactly two blank lines between top-level function definitions.
- Linting: We highly recommend running
blackorflake8on your code before submitting a Pull Request (PR).
If you want to add or modify malicious URL signatures:
- Ensure your signature follows the standard Suricata ruleset structure used in this project.
- Keep the variables, metadata formats (
created_et), and classification types (social-engineering) consistent. - Submit a Pull Request (PR) with your rule additions.
If you want to add new malicious domains to the DNS threat feed:
- Do not manually modify the core Python script logic for this.
- Directly append the new domains to the
phishing.lstfile. - Submit a Pull Request (PR) with the updated list.
Have ideas to improve this README, add tutorials, or clarify usage?
- Open an Issue outlining your proposed changes.
- Once discussed, you can submit a PR targeting the specific Markdown files.
For any bugs, feature requests, or general rule updates where you cannot provide code directly, please feel free to open an Issue in the repository.
Maintaining this project requires active resources, automated testing environments, and software licenses. If you find this ruleset valuable and would like to support its ongoing development and maintenance, financial contributions are greatly appreciated.
You can donate directly via Pix:
- Pix Key:
08650081401
Your financial support helps cover the necessary software licensing fees and infrastructure costs required to keep the feed alive and accurate.
- Fork the repository.
- Clone your fork locally:
git clone https://github.com... - Create a new branch for your feature:
git checkout -b feature/my-new-contribution - Commit your changes with clear messages:
git commit -m "Add malicious domain to phishing.lst" - Push to your branch:
git push origin feature/my-new-contribution - Open a Pull Request against our
mainbranch.