svn commit: r1935685 - spamassassin/trunk/rulesrc/sandbox/jhardin

Author: jhardin
Date: Sat Jun 27 17:48:39 2026
New Revision: 1935685

Log:
Add PHP-based redirector observed in phishing

Modified:
   spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf

Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf	Sat Jun 27 16:48:17 2026	(r1935684)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf	Sat Jun 27 17:48:39 2026	(r1935685)
@@ -4481,7 +4481,10 @@ uri        __CASINO_HKR_TGRAM_2        m
 uri        __URI_REPLIT_DEV           m,^https?://(?:[^./]+\.)+replit\.dev/,i
 meta       URI_REPLIT_DEV             __URI_REPLIT_DEV
 score      URI_REPLIT_DEV             3.000 # limit
-describe   URI_REPLIT_DEV             replit.dev URL, likely phishing
+describe   URI_REPLIT_DEV             replit.dev URL, probably phishing
 tflags     URI_REPLIT_DEV             publish
 
+# observed in phishing
+redirector_pattern                    m;^https?://[^?]+/Jump_ExternalUrl\.php\?url=(.+);i
+