You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2024/01/28 16:51:30 UTC
svn commit: r1915430 - /spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Sun Jan 28 16:51:30 2024
New Revision: 1915430
URL: http://svn.apache.org/viewvc?rev=1915430&view=rev
Log:
"trust wallet" obfuscation, probable cryptocurrency phishing
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1915430&r1=1915429&r2=1915430&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Sun Jan 28 16:51:30 2024
@@ -2090,6 +2090,14 @@ ifplugin Mail::SpamAssassin::Plugin::Rep
describe FUZZY_OVERSTOCK Obfuscated "overstock"
tflags FUZZY_OVERSTOCK publish
+ body __FUZZY_TRUSTWALLET_BODY /(?=<T>)(?!Trust[-\s]?Wallet)<T><R><U><S><T>[-\s]*<W><A><L><L><E><T>/i
+ replace_rules __FUZZY_TRUSTWALLET_BODY
+ header __FUZZY_TRUSTWALLET_FROM From =~ /(?=<T>)(?!Trust[-\s]?Wallet)<T><R><U><S><T>[-\s]*<W><A><L><L><E><T>/i
+ replace_rules __FUZZY_TRUSTWALLET_FROM
+ meta FUZZY_TRUSTWALLET __FUZZY_TRUSTWALLET_BODY || __FUZZY_TRUSTWALLET_FROM
+ describe FUZZY_TRUSTWALLET Obfuscated "Trust Wallet", probable phishing
+ tflags FUZZY_TRUSTWALLET publish
+
else
meta __FUZZY_MONERO 0
body __BITCOIN /\bB[-\s]?i[-\s]?t[-\s]?c[-\s]?o[-\s]?i[-\s]?n\b/i
@@ -3417,7 +3425,7 @@ tflags URI_IMG_WP_REDIR p
meta URI_IMG_CWINDOWSNET __URI_IMG_CWINDOWSNET
score URI_IMG_CWINDOWSNET 3.500 # limit
-describe URI_IMG_CWINDOWSNET Non-MSFT image hosted by Microsoft Azure infra, likely phishing
+describe URI_IMG_CWINDOWSNET Non-MSFT image hosted by Microsoft Azure infra, possible phishing
tflags URI_IMG_CWINDOWSNET publish