You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2026/06/13 00:49:49 UTC
svn commit: r1935216 - spamassassin/trunk/rulesrc/sandbox/jhardin
Author: jhardin
Date: Sat Jun 13 00:49:49 2026
New Revision: 1935216
Log:
replit.dev URL strong abuse sign in public email
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Sat Jun 13 00:45:04 2026 (r1935215)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Sat Jun 13 00:49:49 2026 (r1935216)
@@ -4476,3 +4476,12 @@ tflags __RI_ZWNJ_OBFU m
body __CASINO_HKR_TGRAM_1 /Telegram (?:at )?\@(?:denisv9|emaildba)\b/i
uri __CASINO_HKR_TGRAM_2 m;^https://t\.me/(?:denisv9|emaildba)\b;i
+# free app/content hosting. replit.dev should never be seen in public as those are ephemeral dev instances
+# observed in phishing
+uri __URI_REPLIT_DEV m,^https?://(?:[^./]+\.)+replit\.dev/,i
+meta URI_REPLIT_DEV __URI_REPLIT_DEV
+score URI_REPLIT_DEV 3.000 # limit
+describe URI_REPLIT_DEV replit.dev URL, likely phishing
+tflags URI_REPLIT_DEV publish
+
+