You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2025/08/17 21:13:29 UTC
svn commit: r1927844 - spamassassin/trunk/rulesrc/sandbox/jhardin
Author: jhardin
Date: Sun Aug 17 21:13:29 2025
New Revision: 1927844
Log:
Promote .cn URI spoof to scored, add another .cn phishing rule.
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Sun Aug 17 18:45:02 2025 (r1927843)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Sun Aug 17 21:13:29 2025 (r1927844)
@@ -4445,8 +4445,20 @@ score URI_DOTCN_LOGIN 1
describe URI_DOTCN_LOGIN Login page in .cn subdomain - possible Chinese phishing
tflags URI_DOTCN_LOGIN publish
+body __JP_PASSWORD /\xE3\x83\x91\xE3\x82\xB9\xE3\x83\xAF\xE3\x83\xBC\xE3\x83\x89/
+
+meta CN_PHISH_JP_02 __CN_URL && __JP_PASSWORD
+score CN_PHISH_JP_02 2.500 # limit
+describe CN_PHISH_JP_02 JP "password" + .cn URL - possible Chinese phishing
+tflags CN_PHISH_JP_02 publish
+
+
ifplugin Mail::SpamAssassin::Plugin::URIDetail
uri_detail __URI_DOTCN_SPOOF text =~ m;^https?://(?:[^./]+\.)+(?!cn/)[^/]+/;i domain =~ /\.cn$/i
+ meta URI_DOTCN_SPOOF __URI_DOTCN_SPOOF
+ score URI_DOTCN_SPOOF 2.500 # limit
+ describe URI_DOTCN_SPOOF .CN TLD for non-.CN visible URL - possible Chinese phishing
+ tflags URI_DOTCN_SPOOF publish
endif