stamparm/maltrail

Health v2 · maintenance only

Adoption not part of the score

8587 stars · 1263 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Maltrail is a malicious network traffic detection system that matches observed domains, URLs, IP addresses, and User-Agent values against over 1.5 million threat-intelligence indicators (trails), supplemented by heuristics for scanning, DGA-like DNS, and suspicious traffic. It consists of a high-performance Rust packet sensor using libpcap and a Python server providing event intake, an HTTP API, and a web reporting interface.

Use cases

• detect malware command-and-control traffic on my network
• monitor DNS and HTTP traffic for connections to known malicious IPs and domains
• self-hosted network intrusion detection system
• alert when devices on my network contact botnet or malware infrastructure
• detect DGA domains and suspicious DNS behavior
• feed threat intelligence blacklists into network monitoring
• log and report suspicious network events with a web UI

When to choose

• you need indicator-based network detection with a large, continuously updated trail feed
• you want a self-hosted NIDS with a lightweight, fast packet sensor (Rust, ~1M packets/s on a Pi 5)
• you need plain-text, version-controllable custom trails and whitelists
• you want integration with syslog/CEF, Logstash, or Prometheus metrics

When to avoid

• you need an intrusion *prevention* system that blocks traffic - Maltrail only detects and reports
• you need endpoint detection and response (EDR) or host-based telemetry
• you need deep packet inspection or full protocol analysis beyond indicator matching and heuristics
• you require a Windows-native sensor deployment

Facets

application · maturity active

monitoring security networking logging alerting security networking monitoring self-hosted python rust self-hosted cli intrusion-detection network-monitoring malware-detection threat-intelligence ids packet-capture sensor nids linux docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="stamparm/maltrail")