svn commit: r1929216 - spamassassin/trunk/rulesrc/sandbox/jhardin
| Newsgroups | gmane.mail.spam.spamassassin.cvs |
|---|---|
| Message-ID | <176081942225.3802621.4027226737371165813@svn02-us-east.apache.org> |
Author: jhardin
Date: Sat Oct 18 20:30:21 2025
New Revision: 1929216
Log:
improve cn->jp phishing rule
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Sat Oct 18 20:10:03 2025 (r1929215)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Sat Oct 18 20:30:21 2025 (r1929216)
@@ -4434,7 +4434,7 @@ redirector_pattern m
# Lots of .CN phishing of .JP lately
uri __URI_DOTJP m;^https?://(?:[^./]+\.)+jp/;i
-uri __URI_DOTCN_LOGIN m;^https?://(?:[^./]{4,}\.){2,}cn/[^/]*login[^/]*/;i
+uri __URI_DOTCN_LOGIN m;^https?://(?:[^./]{4,}\.){2,}cn/(?:(?:(?!login)[^/])+/)?[^/]*login[^/]*/;i
meta CN_PHISH_JP_01 __URI_DOTJP && __URI_DOTCN_LOGIN
score CN_PHISH_JP_01 3.000 # limit
describe CN_PHISH_JP_01 Apparent Chinese phishing of Japanese target