svn commit: r1935216 - spamassassin/trunk/rulesrc/sandbox/jhardin

Author: jhardin
Date: Sat Jun 13 00:49:49 2026
New Revision: 1935216

Log:
replit.dev URL strong abuse sign in public email

Modified:
   spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf

Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf	Sat Jun 13 00:45:04 2026	(r1935215)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf	Sat Jun 13 00:49:49 2026	(r1935216)
@@ -4476,3 +4476,12 @@ tflags     __RI_ZWNJ_OBFU              m
 body       __CASINO_HKR_TGRAM_1        /Telegram (?:at )?\@(?:denisv9|emaildba)\b/i
 uri        __CASINO_HKR_TGRAM_2        m;^https://t\.me/(?:denisv9|emaildba)\b;i
 
+# free app/content hosting. replit.dev should never be seen in public as those are ephemeral dev instances
+# observed in phishing
+uri        __URI_REPLIT_DEV           m,^https?://(?:[^./]+\.)+replit\.dev/,i
+meta       URI_REPLIT_DEV             __URI_REPLIT_DEV
+score      URI_REPLIT_DEV             3.000 # limit
+describe   URI_REPLIT_DEV             replit.dev URL, likely phishing
+tflags     URI_REPLIT_DEV             publish
+
+