File Manager - BorneoXploit

Editing: url_suspect.conf

# URL Suspect Plugin Configuration
# Module documentation: https://rspamd.com/doc/modules/url_suspect.html

url_suspect {
  # Enable the plugin
  enabled = true;

# DoS protection: maximum URLs to check per message
  # Protects against messages with 100k+ URLs
  max_urls = 10000;

# Which URL flags trigger inspection (existing flags, no new flags needed)
  # Available: has_user, numeric, obscured, zw_spaces, no_tld, unnormalised
  process_flags = ["has_user", "numeric", "obscured", "zw_spaces", "no_tld"];

# Check configuration
  checks {
    # User/password field analysis
    user_password {
      enabled = true;

# Length thresholds for scoring
      length_thresholds {
        suspicious = 64;     # Score if user field > 64 chars
        long = 128;          # Higher score if > 128
        very_long = 256;     # Even higher if > 256
      }

# OPTIONAL: Advanced pattern matching
      # To enable, add in local.d/url_suspect.conf:
      # pattern_map = "$LOCAL_CONFDIR/local.d/maps/url_suspect_user_patterns.map";

# OPTIONAL: User blacklist
      # To enable, add in local.d/url_suspect.conf:
      # blacklist_map = "$LOCAL_CONFDIR/local.d/maps/url_suspect_user_blacklist.map";
    }

# Numeric IP address analysis
    numeric_ip {
      enabled = true;

# Private IP ranges (10.x, 192.168.x, etc.)
      allow_private_ranges = true;

# OPTIONAL: Suspicious IP ranges map
      # To enable, add in local.d/url_suspect.conf:
      # range_map = "$LOCAL_CONFDIR/local.d/maps/url_suspect_ip_ranges.map";
    }

# TLD (Top Level Domain) analysis
    tld {
      enabled = true;

# Suspicious TLDs map
      # User can override in local.d/maps.d/suspicious_tlds.inc
      # or add local additions in local.d/maps.d/suspicious_tlds.inc.local
      suspicious_tlds_map = [
        "$LOCAL_CONFDIR/local.d/maps.d/suspicious_tlds.inc.local",
        "$LOCAL_CONFDIR/local.d/maps.d/suspicious_tlds.inc",
        "fallback+file://${CONFDIR}/maps.d/suspicious_tlds.inc"
      ];
    }

# Unicode and encoding analysis
    unicode {
      enabled = true;

# All checks use built-in logic (no maps needed)
      check_validity = true;      # Invalid UTF-8 sequences
      check_homographs = true;    # Mixed script homograph attacks
      check_rtl_override = true;  # RTL Unicode override tricks
      check_zero_width = true;    # Zero-width space characters
    }

# URL structure analysis
    structure {
      enabled = true;

# Multiple @ signs
      check_multiple_at = true;
      max_at_signs = 2;

# Backslashes in URL
      check_backslash = true;

# Excessive dots in hostname
      check_excessive_dots = true;
      max_host_dots = 6;

# URL length
      check_length = true;
      max_url_length = 2048;

# OPTIONAL: Suspicious ports map
      # To enable, add in local.d/url_suspect.conf:
      # port_map = "$LOCAL_CONFDIR/local.d/maps/url_suspect_ports.map";
    }
  }

# ADVANCED: Global whitelist
  # To enable, add in local.d/url_suspect.conf:
  # whitelist_map = "$LOCAL_CONFDIR/local.d/maps/url_suspect_whitelist.map";

# ADVANCED: Custom checks
  # To enable, add in local.d/url_suspect.conf:
  # custom_checks {
  #   my_check = <<EOD
  #     return function(task, url, settings)
  #       local host = url:get_host()
  #       if host and host:match("suspicious") then
  #         return {
  #           symbol = "MY_SUSPICIOUS_URL",
  #           score = 5.0,
  #           options = {host}
  #         }
  #       end
  #     end
  # EOD;
  # }

.include(try=true,priority=5) "${DBDIR}/dynamic/url_suspect.conf"
  .include(try=true,priority=1,duplicate=merge) "$LOCAL_CONFDIR/local.d/url_suspect.conf"
  .include(try=true,priority=10) "$LOCAL_CONFDIR/override.d/url_suspect.conf"
}

Cancel