Maltrail
A malicious traffic detection system that monitors network traffic for blacklisted threats and suspicious activities using public feeds and heuristics.
What is Maltrail?
Maltrail is a malicious traffic detection system that passively monitors network traffic to identify threats using publicly available blacklists, static malware trails, and heuristic mechanisms. It detects known malicious domains, IPs, URLs, and suspicious patterns like port scanning or data leakage, helping organizations spot compromised hosts and external attacks.
Network administrators, security analysts, and SOC teams responsible for monitoring and defending organizational networks against malware, scans, and intrusion attempts.
Developers choose Maltrail for its comprehensive threat intelligence aggregation, lightweight sensor-based architecture, and real-time web reporting interface that requires minimal dependencies and offers extensive customization for self-hosted deployments.
Overview
Malicious traffic detection system
Use Cases
Best For
- Detecting malware command-and-control (C&C) communications in network traffic
- Identifying port scanning and mass scanning activities from known attackers
- Monitoring for suspicious DNS requests including DGA domains and dynamic domains
- Spotting data leakage attempts and suspicious HTTP requests like vulnerability scans
- Integrating threat feeds with existing security tools like fail2ban or SIEM systems
- Deploying a lightweight IDS on honeypots or inline monitoring nodes
Not Ideal For
- Environments requiring real-time, automated blocking without additional tool integration like fail2ban
- Teams needing deep packet inspection or behavior-based anomaly detection beyond static lists and basic heuristics
- Organizations with strict compliance requirements for low false positive rates, due to heuristic noise
- Cloud-native deployments where full containerization of sensor components is preferred, as Docker support is limited to the server
Pros & Cons
Pros
Aggregates trails from over 80 public blacklists and static malware entries from AV reports, covering domains, URLs, IPs, and User-Agents for broad detection coverage.
Optional advanced heuristics identify unknown threats like long domain names, excessive failed DNS lookups, and direct executable downloads, enhancing beyond known lists.
Separates sensor, server, and client components, allowing distributed deployment across network monitoring nodes for large-scale or honeypot setups.
Fat-client web UI provides interactive timelines, threat summaries, and detailed event tables with integrated search and tagging for efficient security analysis.
Cons
Requires root privileges for sensor, installation of specific Python packages like pcapy-ng, and manual configuration for multi-node deployments, which can be error-prone.
Heuristic mechanisms, such as detecting suspicious domain lookups or direct file downloads, frequently generate false positives that require manual review and tuning.
Docker support is currently only for the server component, leaving sensor deployment reliant on traditional system-level setup, which complicates modern DevOps workflows.
Relies on continuous updates from public blacklists; if feeds are unavailable or outdated, detection effectiveness diminishes, and maintenance is needed for trail updates.
Frequently Asked Questions
Related Projects
Tsunami Security ScannerTsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.
ArkimeArkime is an open source, large scale, full packet capturing, indexing, and database system.
MolochArkime is an open source, large scale, full packet capturing, indexing, and database system.
FakeNet-NGFakeNet-NG - Next Generation Dynamic Network Analysis Tool
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.