efa-project.org

Just like virus there are also zero day phishing links that have not filtering into any urbl list.

I am trying to get Mailscanner/SA as part of a spam check to add urls is certain free hosting web-sites to be given a score.

In local.cf I have added I sent an email in with the phishing link of http://xc-1-n.tripod.com/ which did not tigger the rule.
So I sent the email in with a click here hyper link to http://xc-1-n.tripod.com/, again did not tigger the rule.

Are there any SA boffins out there that can help?

I am looking to score *.tripod.com which would pick xc-1.tripod.com, we have also had phishing using freewebs.com so I am looking add further domains as appropiate.

I am scoring as 0.1 while I play around, looking to increase it later, maybe 3, and create a whitelist rule (if there is any for legit web-sites) but I do not link we will have any as I already blocked freewebs.com on our outbound proxy, but looking to protect our mobile road warriors has they do not go via the proxy when out and about.

Did you run sa-update and sa-compile? Restarted mailscanner?

yes, let us know if that worked.

I did do both of those.

I did some more reading and found another example that used rawbody

I changed

body TRIPOD1 /\.tripod\.com/

to
and compiled and restarted MailScanner, it did not work, I went to bed, and went to have a look the following day and found it was working, is there a cache somewhere?

I did end up using this
At least the message is tagged as spam, if it fails other test it can quite easily get to score where it quarantined.