svn commit: r1929866 - spamassassin/trunk/rulesrc/sandbox/jhardin
| Newsgroups | gmane.mail.spam.spamassassin.cvs |
|---|---|
| Message-ID | <176355867744.3086747.17256822725639540515@svn02-us-east.apache.org> |
Author: jhardin
Date: Wed Nov 19 13:24:37 2025
New Revision: 1929866
Log:
Add another IPFS provider observed in phishing
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Wed Nov 19 13:13:37 2025 (r1929865)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Wed Nov 19 13:24:37 2025 (r1929866)
@@ -4359,13 +4359,20 @@ describe URI_DWEBIPFS R
score URI_DWEBIPFS 3.500 # limit
tflags URI_DWEBIPFS publish
+uri __URI_W3SIPFS1 m;//[^.]{50,}\.ipfs\.w3s\.link/;i
+uri __URI_W3SIPFS2 m;//w3s\.link/ipfs/[^/?]{50};i
+meta URI_W3SIPFS __URI_W3SIPFS1 || __URI_W3SIPFS2
+describe URI_W3SIPFS References Interplanetary File System PtP content via w3s.link, likely phishing
+score URI_W3SIPFS 3.500 # limit
+tflags URI_W3SIPFS publish
+
uri __URI_FLKIPFSXYZIPFS m;//[^.]{50,}\.ipfs\.flk-ipfs\.xyz/;i
meta URI_FLKIPFSXYZIPFS __URI_FLKIPFSXYZIPFS
describe URI_FLKIPFSXYZIPFS References Interplanetary File System PtP content via flk-ipfs.xyz, likely phishing
score URI_FLKIPFSXYZIPFS 3.500 # limit
tflags URI_FLKIPFSXYZIPFS publish
-meta __URI_IPFS __URI_IPFSIO || __URI_INFURAIPFSIO || __URI_CLOUDFLAREIPFS || __URI_DWEBIPFS || __URI_FLKIPFSXYZIPFS
+meta __URI_IPFS __URI_IPFSIO || __URI_INFURAIPFSIO || __URI_CLOUDFLAREIPFS || __URI_DWEBIPFS || __URI_FLKIPFSXYZIPFS || __URI_W3SIPFS1 || __URI_W3SIPFS2
meta URI_IPFS __URI_IPFS
describe URI_IPFS References Interplanetary File System PtP content, probable phishing
score URI_IPFS 3.500 #limit