Maltrail

Maltrail is a malicious traffic detection system for network and security admins who want a lightweight way to spot infected hosts, malware callbacks and scanners on their network. It watches traffic, compares domains, URLs, IP addresses and HTTP user agents against public blacklists (“trails”) and its own heuristics, and shows hits in a web dashboard. If you came here for a Maltrail download, the project is published on GitHub by its author, Miroslav Stampar (also known for sqlmap).

Maltrail is free and open source; the engine is MIT-licensed. The 3.x series, released from August 2026, is a major change: the sensor is now written in Rust and the old Python sensor was removed in 3.3, while the server and web UI remain Python. It complements, rather than replaces, full IDS tools such as Suricata, Snort or Zeek.

Maltrail at a glance

What it does

• Captures packets with libpcap (Npcap on Windows) on a chosen interface, a mirror/SPAN port or a gateway.
• Matches traffic against trails assembled from dozens of public feeds, a static set compiled from AV reports and your own custom lists.
• Uses heuristics to flag suspicious behaviour that no list knows yet, such as scanning, beaconing and DNS tunnelling.
• Records JA3/JA4 TLS fingerprints and indexes events in SQLite for faster searching in the dashboard (3.2 and later).
• Serves a web dashboard with per-day timelines, top sources and event details; you can view several days at once since 3.3.
• Forwards events to a central Maltrail server, to syslog or to Logstash, and can post alerts to a webhook (Slack, Discord or your own receiver).
• Exposes a /fail2ban endpoint so firewalls can block attackers it detects.

How sysadmins use it

Quick install of sensor and server on one Linux box

1. Read the install script first, then run the official one-liner as root:

   curl -fsSL https://raw.githubusercontent.com/stamparm/maltrail/master/install.sh | sudo sh

2. Edit /etc/maltrail.conf and set the capture interface, for example MONITOR_INTERFACE eth1 for a port connected to a switch SPAN port.
3. Open the dashboard at http://<server>:8338. The default login is admin / changeme!; change it immediately (next task).

Change the default dashboard password

1. Generate a SHA-256 hash of the new password:

   echo -n 'NewStrongPassword' | sha256sum | cut -d " " -f 1

2. Replace the hash in the USERS section of /etc/maltrail.conf. The format is username:sha256:UID:netmask_filter, for example:

   USERS
       admin:<paste-hash-here>:0:

3. Restart the server process. If the dashboard will be reachable beyond a management network, set USE_SSL true or put it behind a reverse proxy with TLS.

Run several sensors with one central server

1. On the server, enable the event listener in maltrail.conf:

   UDP_ADDRESS 0.0.0.0
   UDP_PORT 8337

2. On each sensor (installed with sh install.sh --role sensor), point events to it:

   LOG_SERVER 192.0.2.10:8337

3. Allow UDP 8337 from the sensors to the server in your firewall, and restrict TCP 8338 (dashboard) to admin networks.
4. To send hits to your SIEM as well, set SYSLOG_SERVER to your collector’s address and port.

Add your own indicators

1. Create a directory for custom trails, for example /etc/maltrail/custom, and set CUSTOM_TRAILS_DIR to it.
2. Put one indicator per line (domain, IP or URL) in a text file there, with a comment for the source.
3. Reload the sensor so it picks up the change:

   sudo systemctl reload maltrail-sensor

Install and first run

Linux / BSD / macOS: the install script sets up both roles; building from source needs Rust 1.74+ (cargo), libpcap headers and Python 3. On Debian or Ubuntu that means sudo apt-get install cargo libpcap-dev libcap2-bin python3, then cargo build --release --manifest-path sensor/Cargo.toml and setcap cap_net_raw,cap_net_admin=eip on the sensor binary so it can capture without running as root. Prebuilt sensor binaries are attached to each GitHub release for Linux (GNU and musl), macOS and Windows on x86_64 and aarch64.

Windows: the sensor runs on Windows 10 or later x64 and needs Npcap installed first. The sensor must see the traffic you care about: on a switched network that means a SPAN/mirror port or running it on the gateway. Trails update every 24 hours by default (UPDATE_PERIOD 86400), so the sensor needs outbound HTTPS to GitHub and the feed sites.

Limitations

• It detects, it does not block. Blocking needs the fail2ban endpoint plus your firewall, or a plugin on OPNsense.
• Detection is mostly list-based, so expect false positives from shared hosting IPs and stale feed entries; plan to whitelist with USER_WHITELIST.
• No deep protocol analysis or signatures like Suricata; encrypted traffic is judged by domain, IP and TLS fingerprint only.
• The 3.x rewrite is recent; older guides that describe a Python sensor (sensor.py) are out of date.
• The Trails dataset’s commercial-use restriction matters for MSPs who resell monitoring.

Maltrail vs alternatives

Suricata and Snort are signature-based IDS/IPS engines with far deeper inspection but much more tuning work; Zeek produces rich network logs for analysts. Maltrail is the quick win: a few minutes to deploy and it immediately flags known-bad destinations. Many admins run it next to Suricata on the same mirror port. For host-level visibility of which Windows programs talk to the internet, GlassWire covers a different angle; for storing and querying Maltrail’s syslog output alongside other logs, Grafana Loki works well.

FAQ

Where can I get a Maltrail download?

Use the Download button on this page. Maltrail is developed in the open on GitHub (stamparm/maltrail), which is also where the documentation and release notes live.

What are the Maltrail default credentials?

The dashboard ships with admin / changeme! on port 8338. Replace the password hash in the USERS section right after installation.

Does Maltrail work on OPNsense?

Yes, OPNsense has an os-maltrail plugin in its plugin repository, including a blocklist alias fed from the Maltrail fail2ban endpoint.

Can Maltrail run on Windows?

The Rust sensor runs on Windows 10 or later x64 with Npcap installed. The server needs Python 3.6 or newer.

Is Maltrail free?

The engine is free and open source (MIT). The static Trails dataset is free for internal defence, research and teaching, but commercial services and redistributed feeds need a licence.

What is a Maltrail IOC or trail?

A trail is an indicator such as a domain, URL, IP address or HTTP user agent linked to malware or suspicious activity; Maltrail raises an event when traffic matches one.

Last checked against official sources: 30 September 2026 (developer website: github.com). Versions and licence terms change — confirm on the developer's site before deploying in production.