svn commit: r1928894 - spamassassin/trunk/rulesrc/sandbox/jhardin

Author: jhardin
Date: Thu Oct  2 05:46:41 2025
New Revision: 1928894

Log:
Add rule for snip.ly URLs: site allows third-party web page modifications without owner consent and has been observed in phishing.

Modified:
   spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf

Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf	Thu Oct  2 05:35:49 2025	(r1928893)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf	Thu Oct  2 05:46:41 2025	(r1928894)
@@ -4506,5 +4506,12 @@ redirector_pattern                     m
 header     __FROM_NPMJS_SPOOF          From:addr =~ /\@(?:[^.]+\.)*npmjs(?!\.com$|\.org$)[^\.]*\.[^\.>]+>?$/i
 
 
+# theoretically legit, but allows effective site hijacking and has been observed in phishing, so ding it
+uri        __URI_SNIP_LY               m;^[a-z]+://snip\.ly/;i
+meta       URI_SNIP_LY                 __URI_SNIP_LY
+describe   URI_SNIP_LY                 snip.ly URI: third-party website rewriting, possible phishing
+score      URI_SNIP_LY                 2.000	# limit
+tflags     URI_SNIP_LY                 publish
+