svn commit: r1927844 - spamassassin/trunk/rulesrc/sandbox/jhardin

Author: jhardin
Date: Sun Aug 17 21:13:29 2025
New Revision: 1927844

Log:
Promote .cn URI spoof to scored, add another .cn phishing rule.

Modified:
   spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf

Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf	Sun Aug 17 18:45:02 2025	(r1927843)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf	Sun Aug 17 21:13:29 2025	(r1927844)
@@ -4445,8 +4445,20 @@ score      URI_DOTCN_LOGIN             1
 describe   URI_DOTCN_LOGIN             Login page in .cn subdomain - possible Chinese phishing
 tflags     URI_DOTCN_LOGIN             publish
 
+body       __JP_PASSWORD               /\xE3\x83\x91\xE3\x82\xB9\xE3\x83\xAF\xE3\x83\xBC\xE3\x83\x89/
+
+meta       CN_PHISH_JP_02              __CN_URL && __JP_PASSWORD
+score      CN_PHISH_JP_02              2.500	# limit
+describe   CN_PHISH_JP_02              JP "password" + .cn URL - possible Chinese phishing
+tflags     CN_PHISH_JP_02              publish
+
+
 ifplugin Mail::SpamAssassin::Plugin::URIDetail
   uri_detail   __URI_DOTCN_SPOOF       text =~ m;^https?://(?:[^./]+\.)+(?!cn/)[^/]+/;i domain =~ /\.cn$/i
+  meta         URI_DOTCN_SPOOF         __URI_DOTCN_SPOOF
+  score        URI_DOTCN_SPOOF         2.500	# limit
+  describe     URI_DOTCN_SPOOF         .CN TLD for non-.CN visible URL - possible Chinese phishing
+  tflags       URI_DOTCN_SPOOF         publish
 endif