You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2024/09/27 14:57:32 UTC
svn commit: r1920991 - /spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Fri Sep 27 14:57:31 2024
New Revision: 1920991
URL: http://svn.apache.org/viewvc?rev=1920991&view=rev
Log:
Tune phishing OBFU rules. Add another IPFS provider I missed before.
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1920991&r1=1920990&r2=1920991&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Fri Sep 27 14:57:31 2024
@@ -4187,15 +4187,16 @@ tflags VISTA_TONOM_EQ_TOLOC p
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
- replace_tag SHY (?:=ad|[\xc2][\xad]|[\xad]|&\#xad;|&\#173;|­)
- rawbody __SHY_OBFU_PASSWORD /p(?!assword)<SHY>{0,3}a<SHY>{0,3}s<SHY>{0,3}s<SHY>{0,3}w<SHY>{0,3}o<SHY>{0,3}r<SHY>{0,3}d/i
+ # add RTL codes to soft hyphen, neither is normally displayed bt useful for obfuscation
+ replace_tag SHY (?:=ad|[\xc2][\xad]|[\xad]|&\#xad;|&\#173;|­|\x{E2}\x{80}\x{8F})
+ rawbody __SHY_OBFU_PASSWORD /p(?!assword)<SHY>{0,6}a<SHY>{0,6}s<SHY>{0,6}s<SHY>{0,6}w<SHY>{0,6}o<SHY>{0,6}r<SHY>{0,6}d/i
replace_rules __SHY_OBFU_PASSWORD
meta SHY_OBFU_PASSWORD __SHY_OBFU_PASSWORD
describe SHY_OBFU_PASSWORD Obfuscation, probable phishing
score SHY_OBFU_PASSWORD 4.000 # limit
tflags SHY_OBFU_PASSWORD publish
- rawbody __SHY_OBFU_EXPIRE /e(?!xpire)<SHY>{0,3}x<SHY>{0,3}p<SHY>{0,3}i<SHY>{0,3}r<SHY>{0,3}e/i
+ rawbody __SHY_OBFU_EXPIRE /e(?!xpire)<SHY>{0,6}x<SHY>{0,6}p<SHY>{0,6}i<SHY>{0,6}r<SHY>{0,6}e/i
replace_rules __SHY_OBFU_EXPIRE
meta SHY_OBFU_EXPIRE __SHY_OBFU_EXPIRE
describe SHY_OBFU_EXPIRE Obfuscation, probable phishing
@@ -4216,6 +4217,12 @@ describe URI_IPFSIO R
score URI_IPFSIO 3.500 # limit
tflags URI_IPFSIO publish
+uri __URI_INFURAIPFSIO m,://(?:[^@/]+@)?(?:[^.]+\.)?infura-ipfs\.io/ipfs/,i
+meta URI_INFURAIPFSIO __URI_INFURAIPFSIO
+describe URI_INFURAIPFSIO References Interplanetary File System PtP content via infura-ipfs.io, likely phishing
+score URI_INFURAIPFSIO 3.500 # limit
+tflags URI_INFURAIPFSIO publish
+
uri __URI_CLOUDFLAREIPFS m,://(?:[^@/]+@)?cloudflare-ipfs\.com/ipfs/,i
meta URI_CLOUDFLAREIPFS __URI_CLOUDFLAREIPFS
describe URI_CLOUDFLAREIPFS References Interplanetary File System PtP content via CloudFlare, likely phishing
@@ -4253,8 +4260,9 @@ header __TO_EQ_CC_2 A
meta __TO_EQ_CC (__TO_EQ_CC_1 || __TO_EQ_CC_2)
describe __TO_EQ_CC To: same as Cc:
-# Seen in phishing; may be other similar variants: U202B, U202E
+# Seen in phishing as variant of __SHY_OBFU_PASSWORD; may be other similar variants: U202B, U202E
body __UNICODE_RTL_OBFU /\w(?:\x{E2}\x{80}\x{8F}){2,}\w/
tflags __UNICODE_RTL_OBFU multiple maxhits=10
+meta __UNICODE_RTL_OBFU_SOME __UNICODE_RTL_OBFU > 4 && __UNICODE_RTL_OBFU <= 9
meta __UNICODE_RTL_OBFU_MANY __UNICODE_RTL_OBFU > 9