Repolode
Submit
stamparm

stamparm/maltrail

Network traffic monitor that flags communication with known malicious domains, IPs, URLs and User-Agents using indicator lists called trails.

View on GitHubWebsite
Stars
8,630
Forks
1,266
Open issues
37
Last commit
2 days ago

What is it?

Maltrail watches network traffic and matches domains, URLs, IP addresses, IP:port pairs and User-Agent values against a set of indicators called trails. Each detection is recorded as one event with source, destination, protocol, matched trail, classification and trail source. It also includes heuristics for scanning, DNS exhaustion, DGA-like lookups, suspicious downloads and proxy probes.

The system has two separately deployable parts. A multithreaded Rust sensor built on libpcap captures traffic and produces events. A Python server stores events from local logs or remote sensors and provides a browser reporting interface with live updates, search, retro hunting and CSV/JSON export, plus an HTTP API for indicator lookups. Events can also be sent to a remote server, to syslog as CEF, or to Logstash as JSON.

Trails come from a static indicator set, bundled public feeds, and operator-supplied custom lists and whitelists. The static set is licensed separately from the MIT-licensed engine, and commercial redistribution requires permission.

Key features

  • 01Matches domains, URLs, IPs, IP:port pairs and User-Agents against trail indicator lists.
  • 02Rust sensor using libpcap, with optional Linux PACKET_FANOUT capture workers.
  • 03Browser dashboard with live updates, field-aware search and retro hunting over retained logs.
  • 04Plain-text custom trails and whitelists that can be version-controlled.
  • 05Forwards events to remote servers, syslog (CEF), or Logstash (JSON).
  • 06Includes a `maltrail-sensor -T` validation command and optional Prometheus metrics.

Use cases

  • Detecting hosts on a home or office network that contact known malware infrastructure.
  • Feeding network indicator events into a SIEM through syslog or Logstash.
  • Running a sensor on a gateway or tap to watch outbound DNS and HTTP traffic.
  • Looking up whether a domain or IP appears in known malicious indicator lists.

Quick start

  1. 1

    Run the installer (review the script first, it needs root)

    Install with the official instructions in the README
  2. 2

    Wait for the initial trail build to finish (can take several minutes)

  3. 3

    Open the dashboard at http://127.0.0.1:8338 and change the default credentials

Things to know

  • The default login is admin / changeme!, so change USERS before use.
  • The shipped HTTP_ADDRESS is 0.0.0.0, which exposes the dashboard on every interface unless changed.
  • The initial trail build takes several minutes, and no trail matches are detected until it completes.

Topics

#network-monitoring#intrusion-detection#malware#threat-intelligence#packet-capture#security-monitoring#attack-detection#python#rust#security

FAQ

What is maltrail?
Network traffic monitor that flags communication with known malicious domains, IPs, URLs and User-Agents using indicator lists called trails. Maltrail watches network traffic and matches domains, URLs, IP addresses, IP:port pairs and User-Agent values against a set of indicators called trails. Each detection is recorded as one event with source, destination, protocol, matched trail, classification and trail source. It also includes heuristics for scanning, DNS exhaustion, DGA-like lookups, suspicious downloads and proxy probes.
Is maltrail free to use? What license does it have?
maltrail is open source under the MIT license. Check the license terms before using it in commercial products.
Is maltrail still maintained?
Actively maintained. The last commit to maltrail was on Oct 18, 2026.
What can I use maltrail for?
Detecting hosts on a home or office network that contact known malware infrastructure. Feeding network indicator events into a SIEM through syslog or Logstash. Running a sensor on a gateway or tap to watch outbound DNS and HTTP traffic. Looking up whether a domain or IP appears in known malicious indicator lists.
How do I install maltrail?
Run the installer (review the script first, it needs root) Wait for the initial trail build to finish (can take several minutes) Open the dashboard at http://127.0.0.1:8338 and change the default credentials
Where can I get maltrail?
The source code and installation instructions are on GitHub: https://github.com/stamparm/maltrail

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects