svn commit: r1927819 - spamassassin/trunk/rulesrc/sandbox/jhardin

Author: jhardin
Date: Sat Aug 16 19:17:32 2025
New Revision: 1927819

Log:
Add another chinese phishing rule for eval

Modified:
   spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf

Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf	Sat Aug 16 13:05:16 2025	(r1927818)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf	Sat Aug 16 19:17:32 2025	(r1927819)
@@ -4436,7 +4436,7 @@ redirector_pattern                     m
 uri        __URI_DOTJP                 m;^https?://(?:[^./]+\.)+jp/;i
 uri        __URI_DOTCN_LOGIN           m;^https?://(?:[^./]{4,}\.){2,}cn/[^/]*login[^/]*/;i 
 meta       CN_PHISH_JP_01              __URI_DOTJP && __URI_DOTCN_LOGIN
-score      CN_PHISH_JP_01              2.500	# limit
+score      CN_PHISH_JP_01              3.000	# limit
 describe   CN_PHISH_JP_01              Apparent Chinese phishing of Japanese target
 tflags     CN_PHISH_JP_01              publish
 
@@ -4445,6 +4445,10 @@ score      URI_DOTCN_LOGIN             1
 describe   URI_DOTCN_LOGIN             Login page in .cn subdomain - possible Chinese phishing
 tflags     URI_DOTCN_LOGIN             publish
 
+ifplugin Mail::SpamAssassin::Plugin::URIDetail
+  uri_detail   __URI_DOTCN_SPOOF       text =~ m;^https?://(?:[^./]+\.)+(?!cn/)[^/]+/;i domain =~ /\.cn$/i
+endif  
+
 
 # seen in phishing emails for captured data exfil
 uri        __TELEGRAM_MESSAGE          m;^https?://api\.telegram\.org/bot[^/]+/sendMessage;i