{"adoption": {"forks": 1263, "observed_at": "2026-08-28T04:10:23.671480+00:00", "stars": 8587}, "canonical_url": "https://ross.abutalabs.com/products/maltrail", "card": {"archived": false, "artifact_type": "application", "description": "Malicious traffic detection system", "domain": ["security", "networking", "monitoring", "self-hosted"], "enriched": true, "function": ["monitoring", "security", "networking", "logging", "alerting"], "health_score": 100, "homepage": "https://www.sekuripy.hr/labs/maltrail/", "language": "Python", "license": "MIT", "license_family": "permissive", "maturity": "active", "member_repos": ["stamparm/maltrail"], "name": "stamparm/maltrail", "platform": ["python", "rust", "self-hosted", "cli"], "pushed_at": "2026-08-26T19:45:49+00:00", "repo": "stamparm/maltrail", "stars": 8587, "tags": ["intrusion-detection", "network-monitoring", "malware-detection", "threat-intelligence", "ids", "packet-capture", "sensor", "nids", "linux", "docker"], "topics": ["security", "malware", "intrusion-detection", "sensor", "python", "network-monitoring", "attack-detection", "rust"], "urls": [], "use_cases": ["detect malware command-and-control traffic on my network", "monitor DNS and HTTP traffic for connections to known malicious IPs and domains", "self-hosted network intrusion detection system", "alert when devices on my network contact botnet or malware infrastructure", "detect DGA domains and suspicious DNS behavior", "feed threat intelligence blacklists into network monitoring", "log and report suspicious network events with a web UI"], "what_it_is": "Maltrail is a malicious network traffic detection system that matches observed domains, URLs, IP addresses, and User-Agent values against over 1.5 million threat-intelligence indicators (trails), supplemented by heuristics for scanning, DGA-like DNS, and suspicious traffic. It consists of a high-performance Rust packet sensor using libpcap and a Python server providing event intake, an HTTP API, and a web reporting interface.", "when_to_avoid": ["you need an intrusion *prevention* system that blocks traffic - Maltrail only detects and reports", "you need endpoint detection and response (EDR) or host-based telemetry", "you need deep packet inspection or full protocol analysis beyond indicator matching and heuristics", "you require a Windows-native sensor deployment"], "when_to_choose": ["you need indicator-based network detection with a large, continuously updated trail feed", "you want a self-hosted NIDS with a lightweight, fast packet sensor (Rust, ~1M packets/s on a Pi 5)", "you need plain-text, version-controllable custom trails and whitelists", "you want integration with syslog/CEF, Logstash, or Prometheus metrics"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/maltrail", "repo": "stamparm/maltrail", "role": "main", "score": 98}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:10:23.671480+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-29T17:26:15.261979+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "99fcf73f3ff556af4a04653333d8963cfdcebadbbacb194757c44170e3a324e5", "fetched_at": "2026-08-28T04:10:23.671480+00:00", "kind": "readme", "missing": false, "url": "https://github.com/stamparm/maltrail"}, {"content_hash": "348bc9185fa7a4e4919e88fcf05a97bca0c911c726446a580a9b504b2f3c62e9", "fetched_at": "2026-08-29T08:26:30.688525+00:00", "kind": "homepage", "missing": false, "url": "https://www.sekuripy.hr/labs/maltrail/"}, {"content_hash": "bb333cfb35a0c03c0faacb7147014d47ec8004e2d5390a8d087442aa7701a324", "fetched_at": "2026-08-29T08:26:30.691623+00:00", "kind": "site_page", "missing": false, "url": "https://www.sekuripy.hr/about"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:10:23.671480+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-29T17:26:15.261979+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "99fcf73f3ff556af4a04653333d8963cfdcebadbbacb194757c44170e3a324e5", "fetched_at": "2026-08-28T04:10:23.671480+00:00", "kind": "readme", "missing": false, "url": "https://github.com/stamparm/maltrail"}, {"content_hash": "348bc9185fa7a4e4919e88fcf05a97bca0c911c726446a580a9b504b2f3c62e9", "fetched_at": "2026-08-29T08:26:30.688525+00:00", "kind": "homepage", "missing": false, "url": "https://www.sekuripy.hr/labs/maltrail/"}, {"content_hash": "bb333cfb35a0c03c0faacb7147014d47ec8004e2d5390a8d087442aa7701a324", "fetched_at": "2026-08-29T08:26:30.691623+00:00", "kind": "site_page", "missing": false, "url": "https://www.sekuripy.hr/about"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-29T17:26:15.261979+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "99fcf73f3ff556af4a04653333d8963cfdcebadbbacb194757c44170e3a324e5", "fetched_at": "2026-08-28T04:10:23.671480+00:00", "kind": "readme", "missing": false, "url": "https://github.com/stamparm/maltrail"}, {"content_hash": "348bc9185fa7a4e4919e88fcf05a97bca0c911c726446a580a9b504b2f3c62e9", "fetched_at": "2026-08-29T08:26:30.688525+00:00", "kind": "homepage", "missing": false, "url": "https://www.sekuripy.hr/labs/maltrail/"}, {"content_hash": "bb333cfb35a0c03c0faacb7147014d47ec8004e2d5390a8d087442aa7701a324", "fetched_at": "2026-08-29T08:26:30.691623+00:00", "kind": "site_page", "missing": false, "url": "https://www.sekuripy.hr/about"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:10:23.671480+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:10:23.671480+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:10:23.671480+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-29T17:26:15.261979+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "99fcf73f3ff556af4a04653333d8963cfdcebadbbacb194757c44170e3a324e5", "fetched_at": "2026-08-28T04:10:23.671480+00:00", "kind": "readme", "missing": false, "url": "https://github.com/stamparm/maltrail"}, {"content_hash": "348bc9185fa7a4e4919e88fcf05a97bca0c911c726446a580a9b504b2f3c62e9", "fetched_at": "2026-08-29T08:26:30.688525+00:00", "kind": "homepage", "missing": false, "url": "https://www.sekuripy.hr/labs/maltrail/"}, {"content_hash": "bb333cfb35a0c03c0faacb7147014d47ec8004e2d5390a8d087442aa7701a324", "fetched_at": "2026-08-29T08:26:30.691623+00:00", "kind": "site_page", "missing": false, "url": "https://www.sekuripy.hr/about"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:10:23.671480+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:10:23.671480+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-29T17:26:15.261979+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "99fcf73f3ff556af4a04653333d8963cfdcebadbbacb194757c44170e3a324e5", "fetched_at": "2026-08-28T04:10:23.671480+00:00", "kind": "readme", "missing": false, "url": "https://github.com/stamparm/maltrail"}, {"content_hash": "348bc9185fa7a4e4919e88fcf05a97bca0c911c726446a580a9b504b2f3c62e9", "fetched_at": "2026-08-29T08:26:30.688525+00:00", "kind": "homepage", "missing": false, "url": "https://www.sekuripy.hr/labs/maltrail/"}, {"content_hash": "bb333cfb35a0c03c0faacb7147014d47ec8004e2d5390a8d087442aa7701a324", "fetched_at": "2026-08-29T08:26:30.691623+00:00", "kind": "site_page", "missing": false, "url": "https://www.sekuripy.hr/about"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:10:23.671480+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:10:23.671480+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:10:23.671480+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-29T17:26:15.261979+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "99fcf73f3ff556af4a04653333d8963cfdcebadbbacb194757c44170e3a324e5", "fetched_at": "2026-08-28T04:10:23.671480+00:00", "kind": "readme", "missing": false, "url": "https://github.com/stamparm/maltrail"}, {"content_hash": "348bc9185fa7a4e4919e88fcf05a97bca0c911c726446a580a9b504b2f3c62e9", "fetched_at": "2026-08-29T08:26:30.688525+00:00", "kind": "homepage", "missing": false, "url": "https://www.sekuripy.hr/labs/maltrail/"}, {"content_hash": "bb333cfb35a0c03c0faacb7147014d47ec8004e2d5390a8d087442aa7701a324", "fetched_at": "2026-08-29T08:26:30.691623+00:00", "kind": "site_page", "missing": false, "url": "https://www.sekuripy.hr/about"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:10:23.671480+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:10:23.671480+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-29T17:26:15.261979+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "99fcf73f3ff556af4a04653333d8963cfdcebadbbacb194757c44170e3a324e5", "fetched_at": "2026-08-28T04:10:23.671480+00:00", "kind": "readme", "missing": false, "url": "https://github.com/stamparm/maltrail"}, {"content_hash": "348bc9185fa7a4e4919e88fcf05a97bca0c911c726446a580a9b504b2f3c62e9", "fetched_at": "2026-08-29T08:26:30.688525+00:00", "kind": "homepage", "missing": false, "url": "https://www.sekuripy.hr/labs/maltrail/"}, {"content_hash": "bb333cfb35a0c03c0faacb7147014d47ec8004e2d5390a8d087442aa7701a324", "fetched_at": "2026-08-29T08:26:30.691623+00:00", "kind": "site_page", "missing": false, "url": "https://www.sekuripy.hr/about"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-29T17:26:15.261979+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "99fcf73f3ff556af4a04653333d8963cfdcebadbbacb194757c44170e3a324e5", "fetched_at": "2026-08-28T04:10:23.671480+00:00", "kind": "readme", "missing": false, "url": "https://github.com/stamparm/maltrail"}, {"content_hash": "348bc9185fa7a4e4919e88fcf05a97bca0c911c726446a580a9b504b2f3c62e9", "fetched_at": "2026-08-29T08:26:30.688525+00:00", "kind": "homepage", "missing": false, "url": "https://www.sekuripy.hr/labs/maltrail/"}, {"content_hash": "bb333cfb35a0c03c0faacb7147014d47ec8004e2d5390a8d087442aa7701a324", "fetched_at": "2026-08-29T08:26:30.691623+00:00", "kind": "site_page", "missing": false, "url": "https://www.sekuripy.hr/about"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-29T17:26:15.261979+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "99fcf73f3ff556af4a04653333d8963cfdcebadbbacb194757c44170e3a324e5", "fetched_at": "2026-08-28T04:10:23.671480+00:00", "kind": "readme", "missing": false, "url": "https://github.com/stamparm/maltrail"}, {"content_hash": "348bc9185fa7a4e4919e88fcf05a97bca0c911c726446a580a9b504b2f3c62e9", "fetched_at": "2026-08-29T08:26:30.688525+00:00", "kind": "homepage", "missing": false, "url": "https://www.sekuripy.hr/labs/maltrail/"}, {"content_hash": "bb333cfb35a0c03c0faacb7147014d47ec8004e2d5390a8d087442aa7701a324", "fetched_at": "2026-08-29T08:26:30.691623+00:00", "kind": "site_page", "missing": false, "url": "https://www.sekuripy.hr/about"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-29T17:26:15.261979+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "99fcf73f3ff556af4a04653333d8963cfdcebadbbacb194757c44170e3a324e5", "fetched_at": "2026-08-28T04:10:23.671480+00:00", "kind": "readme", "missing": false, "url": "https://github.com/stamparm/maltrail"}, {"content_hash": "348bc9185fa7a4e4919e88fcf05a97bca0c911c726446a580a9b504b2f3c62e9", "fetched_at": "2026-08-29T08:26:30.688525+00:00", "kind": "homepage", "missing": false, "url": "https://www.sekuripy.hr/labs/maltrail/"}, {"content_hash": "bb333cfb35a0c03c0faacb7147014d47ec8004e2d5390a8d087442aa7701a324", "fetched_at": "2026-08-29T08:26:30.691623+00:00", "kind": "site_page", "missing": false, "url": "https://www.sekuripy.hr/about"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 99, "longevity": 100, "rhythm": 97}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": [], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 4290, "days_push": 7, "days_rel": 22, "gap_med": 29.0, "n_releases_24m": 11}, "score": 98, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}