You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2026/03/27 01:37:10 UTC
svn commit: r1932584 - spamassassin/trunk/rulesrc/sandbox/jhardin
Author: jhardin
Date: Fri Mar 27 01:37:10 2026
New Revision: 1932584
Log:
Add rule to check legitimacy of suspicious Google infra URL
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Fri Mar 27 01:18:03 2026 (r1932583)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Fri Mar 27 01:37:10 2026 (r1932584)
@@ -4549,6 +4549,8 @@ tflags URI_SNIP_LY p
# URL obfuscation observed in phishing
uri __URI_ABOUT_OBFU m;^about:https?://;i
-
+# Google Drive files that are opened or previewed by third-party apps (e.g., apps integrated via the Google Drive API or Workspace Marketplace)
+# Observed in scam to retrieve PDF icon
+uri __URI_D3P_GUC m;^https://drive-thirdparty\.googleusercontent\.com/;i