---
title: Phishing
url: 'https://docs.danami.com/warden/user-guide/antispam-plugins/phishing'
markdown: 'https://docs.danami.com/warden/user-guide/antispam-plugins/phishing.md'
date: '2026-10-01'
description: 'This plugin was introduced in Spamassassin 3.4.2. This plugin finds URIs used in phishing campaigns as detected by the OpenPhish and PhishTank feeds. The Openphish free feed is updated every 6 hours and will be automatically downloaded from https://openphish.com/feed.txt (The Premium Ope…'
taxonomy:
  category:
    - docs
  tag:
    - phishing
---

[](#)  [ Basics ](https://docs.danami.com/warden/)     [ User Guide ](https://docs.danami.com/warden/user-guide)     [ Anti-spam Plugins ](https://docs.danami.com/warden/user-guide/antispam-plugins)      Phishing    

# Phishing

> > > > > This plugin was introduced in Spamassassin 3.4.2.

This plugin finds URIs used in phishing campaigns as detected by the OpenPhish and PhishTank feeds.

- The Openphish free feed is updated every 6 hours and will be automatically downloaded from <https://openphish.com/feed.txt> (The Premium Openphish feed is not currently supported)
- The PhishTank free feed is updated hourly and will be automatically downloaded from <https://data.phishtank.com/data/online-valid.csv>. Sign up for an API key at [https://www.phishtank.com/api\_register.php](https://www.phishtank.com/api_register.php). The feed is rate limited so we recommend using different application keys if you have a lot of servers.

## How it works

The plugin automatically downloads and maintains the OpenPhish and PhishTank feeds. When a message is scanned, it extracts the URIs from the message and compares them against the feed entries; when a URI matches, the `URI_PHISHING` rule fires. The score applied to the rule is controlled by `uri_phishing_score`.

## Rules

| Area | Rule name | Description | Default scores |
|---|---|---|---|
| body | `URI_PHISHING` | URL match in phishing feed | 100.0 |

## Related Pages

- [Phishing Settings](https://docs.danami.com/warden/settings/antispam/plugin-settings/phishing "Phishing Settings")

 [](https://docs.danami.com/warden/command-line-interface/antispam/antispam-plugin-phishing)

---

## Navigation

- Parent: [Anti-spam Plugins](https://docs.danami.com/warden/user-guide/antispam-plugins.md)
- Previous: [PDFInfo](https://docs.danami.com/warden/user-guide/antispam-plugins/pdfinfo.md)
- Next: [Pyzor](https://docs.danami.com/warden/user-guide/antispam-plugins/pyzor.md)