YALIH YALIH (Yet Another Low Interaction Honeyclient) is a low interaction client honeypot designed to detect malicious websites through signature, anomaly and pattern matching techniques. The tool collects suspicious URLs from multiple sources including malicious website databases, Bing API searches, and email inboxes through POP3 and IMAP protocols. It performs JavaScript extraction, de-obfuscation and de-minification of scripts embedded within websites. YALIH YALIH includes referrer emulation and redirection handling capabilities, along with cookies and session management. The system emulates browsers, browser agents and operating systems to appear as legitimate clients. It supports proxy capabilities to detect geo-location and IP cloaking attacks. For detection, the tool uses signature-based detection through ClamAV antivirus database integration and anomaly/pattern matching detection through Yara rules. It includes automated Yara signature generation functionality to create custom detection rules based on observed malicious patterns.