Phishing

This plugin was introduced in Spamassassin 3.4.2.

This plugin finds URIs used in phishing campaigns as detected by the OpenPhish and PhishTank feeds.

• The Openphish free feed is updated every 6 hours and will be automatically downloaded from https://openphish.com/feed.txt (The Premium Openphish feed is not currently supported)
• The PhishTank free feed is updated hourly and will be automatically downloaded from https://data.phishtank.com/data/online-valid.csv. Sign up for an API key at https://www.phishtank.com/api_register.php. The feed is rate limited so we recommend using different application keys if you have a lot of servers.

How it works

The plugin automatically downloads and maintains the OpenPhish and PhishTank feeds. When a message is scanned, it extracts the URIs from the message and compares them against the feed entries; when a URI matches, the URI_PHISHING rule fires. The score applied to the rule is controlled by uri_phishing_score.

Rules

Related Pages

• Phishing Settings