svn commit: r1933124 - spamassassin/trunk/rulesrc/sandbox/jhardin

Author: jhardin
Date: Fri Apr 17 01:17:24 2026
New Revision: 1933124

Log:
digidip (phishing-abused public redirector) has multiple redirector subdomains

Modified:
   spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf

Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf	Thu Apr 16 19:28:19 2026	(r1933123)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf	Fri Apr 17 01:17:24 2026	(r1933124)
@@ -4514,7 +4514,9 @@ header     __PP_GOOGLE_MAESTRO         E
 
 # observed in phishing
 redirector_pattern                     m;^https?://secure\.adnxs\.com/.*[?&]redir=(.+);i
-redirector_pattern                     m;^https?://shopper\.digidip\.net/.*[?&]url=(.+);i
+# digidip has multiple redirector subdomains
+#redirector_pattern                     m;^https?://shopper\.digidip\.net/.*[?&]url=(.+);i
+redirector_pattern                     m;^https?://[^.]+\.digidip\.net/.*[?&]url=(.+);i
 
 
 # npm phishing?