Kudos to aphesz for making the rules. Well basically the rules is to send an email to admin especially for webhosters admin a notification about which site is under phishing attack. Below are the rules that you need to put in web_rules.xml at the end of file but before </group> closing tag.
<rule id=”31190″ level=”12″>
<if_sid>31100</if_sid>
<url>paypal.co|hsbc.co|citibank.co|ebay.co|barclays|amazon.co|</url>
<url>verizon.net|lloyds.com|maybank2u|maybank|e-gold.com</url>
<description>Phishing sites [...]
Posts Tagged ‘hids’
» OSSEC HIDS Phishing detection rule
Sponsors
-
- Pages displayed : 29378
- Unique visitors : 14651
- Pages displayed in last 24 hours : 65
- Unique visitors in last 24 hours : 23
Powered by FireStats