svn commit: r1932584 - spamassassin/trunk/rulesrc/sandbox/jhardin

Author: jhardin
Date: Fri Mar 27 01:37:10 2026
New Revision: 1932584

Log:
Add rule to check legitimacy of suspicious Google infra URL

Modified:
   spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf

Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf	Fri Mar 27 01:18:03 2026	(r1932583)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf	Fri Mar 27 01:37:10 2026	(r1932584)
@@ -4549,6 +4549,8 @@ tflags     URI_SNIP_LY                 p
 # URL obfuscation observed in phishing
 uri        __URI_ABOUT_OBFU            m;^about:https?://;i
 
-
+# Google Drive files that are opened or previewed by third-party apps (e.g., apps integrated via the Google Drive API or Workspace Marketplace)
+# Observed in scam to retrieve PDF icon
+uri        __URI_D3P_GUC               m;^https://drive-thirdparty\.googleusercontent\.com/;i