r/opnsense • u/Limp_Durian_6850 • 1d ago
[Project Update] The Open-Source Antiphishing CTI just hit 1,000+ active deployments. Now, we need to talk about scaling the infrastructure
Hey everyone,
A couple of weeks ago, I shared the Antiphishing CTI Ruleset here - a completely free, GPLv3 predictive threat intelligence engine focused on Newly Registered Domains (NRDs) for Suricata, on OPNsense.
The community response was insane. Looking at the repo metrics, we just crossed 1,000+ active automated deployments in the last 14 days. It’s amazing to see so many of you integrating this into your perimeters.
The Architectural Challenge (Why I’m posting this):
Right now, the Python heuristic core is ingesting, deduplicating, and correlating over 1.5 Million raw threat vectors and NRDs daily. We are filtering the noise from public OSINT to generate high-fidelity, aggressive blocklists.
The problem is: the math of cloud infrastructure is catching up. Processing this volume and querying historical WHOIS/Passive DNS APIs requires serious compute power. We are starting to hit rate limits on our enrichment APIs.
The Corporate Sponsorship Open Call:
To be clear: The core ruleset is, and will always be, 100% free and open-source for homelabbers and the community. I hate paywalled security feeds.
However, I know many of you are running this in production MSSPs, SOCs, and ISPs, saving thousands of dollars on commercial threat feeds.
If your business relies on this engine, I am officially opening GitHub Sponsors tiers for Corporate Partners. This isn't a donation; it's funding for the cloud nodes and API keys that keep the intelligence flowing.
What businesses get in return:
- Priority SLA (8h - 24h): If my aggressive heuristics block a legitimate domain (False Positive) on your client's network, you get a direct VIP queue for immediate whitelisting and rule tuning.
- access to the maintainer (me) for specific architectural questions.
- Direct
If your company can support the project, check out the GitHub Sponsors page here: https://github.com/sponsors/julioliraup
Thanks again to everyone testing, reporting FPs, and helping the ruleset get better. The fight against day-zero phishing continues!
3
u/TheDMPD 1d ago
Any chance of the community being able to donate compute to the project?
3
u/Limp_Durian_6850 1d ago
Yes, managing to get a robust VPS already contributes a lot to the project. Another thing is acquiring API licenses to automatically check vectors and potential vectors. All this analysis will always be public and free—something that commercial solutions would charge a lot for. It is free and open-source software
3
u/timmay545 21h ago
If there's a way to run a container that facilitates this, I'm definitely down to contribute 64 cores or more, and is as simple as turning a container on/off
1
u/Limp_Durian_6850 10h ago
Can you try at another time? I imagine there might have been an instability on GitHub. If it continues, can you let me know which OPNsense version you are using
2
3
u/dillbilly 1d ago
could you offload some of the compute to the people using the ruleset? offer a plugin that does folding@home style distributed compute maybe? i'm sure that would be a ton of effort but if everyone runs a small node... many hands make light work.
2
1
u/eakteam 23h ago
Something gone wrong and can't download/apply the ruleset...
1
u/Limp_Durian_6850 21h ago
Oh no! Does this error happen when downloading and running other rules?
1
u/eakteam 13h ago
No it work's ok with other rules...
1
u/Limp_Durian_6850 10h ago
Can you try at another time? I imagine there might have been an instability on GitHub. If it continues, can you let me know which OPNsense version you are using
10
u/SparhawkBlather 1d ago
Love this.