File Manager - BorneoXploit

Editing: url_suspect_group.conf

# URL Suspect Plugin Scores
# These scores are applied when suspicious URLs are detected
#
# Please don't modify this file as your changes might be overwritten with
# the next update.
#
# You can modify '$LOCAL_CONFDIR/rspamd.conf.local.override' to redefine
# parameters defined on the top level
#
# You can modify '$LOCAL_CONFDIR/rspamd.conf.local' to add
# parameters defined on the top level
#
# For specific modules or configuration you can also modify
# '$LOCAL_CONFDIR/local.d/url_suspect_group.conf' - to add your options or rewrite defaults
# '$LOCAL_CONFDIR/override.d/url_suspect_group.conf' - to override the defaults
#
# See https://rspamd.com/doc/developers/writing_rules.html for details

description = "Suspicious URL checks";

max_score = 9.0;

symbols = {
  # User/password in URL
  "URL_USER_PASSWORD" {
    weight = 2.0;
    description = "URL contains user field";
    one_shot = false;
  }
  "URL_USER_LONG" {
    weight = 3.0;
    description = "URL user field is long (>128 chars)";
    one_shot = false;
  }
  "URL_USER_VERY_LONG" {
    weight = 5.0;
    description = "URL user field is very long (>256 chars)";
    one_shot = false;
  }

# Numeric IP in URL
  "URL_NUMERIC_IP" {
    weight = 1.5;
    description = "URL uses numeric IP address";
    one_shot = false;
  }
  "URL_NUMERIC_IP_USER" {
    weight = 4.0;
    description = "URL uses numeric IP with user field";
    one_shot = false;
  }
  "URL_NUMERIC_PRIVATE_IP" {
    weight = 0.5;
    description = "URL uses private IP range";
    one_shot = false;
  }

# TLD issues
  "URL_NO_TLD" {
    weight = 2.0;
    description = "URL has no TLD";
    one_shot = false;
  }
  "URL_SUSPICIOUS_TLD" {
    weight = 3.0;
    description = "URL uses suspicious TLD";
    one_shot = false;
  }

# Unicode and encoding issues
  "URL_BAD_UNICODE" {
    weight = 3.0;
    description = "URL contains invalid Unicode";
    one_shot = false;
  }
  "URL_HOMOGRAPH_ATTACK" {
    weight = 5.0;
    description = "URL uses homograph attack (mixed scripts)";
    one_shot = false;
  }
  "URL_RTL_OVERRIDE" {
    weight = 6.0;
    description = "URL uses RTL override character";
    one_shot = false;
  }
  "URL_ZERO_WIDTH_SPACES" {
    weight = 7.0;
    description = "URL contains zero-width spaces";
    one_shot = false;
  }

# URL structure issues
  "URL_MULTIPLE_AT_SIGNS" {
    weight = 3.0;
    description = "URL has multiple @ signs";
    one_shot = true;
  }
  "URL_BACKSLASH_PATH" {
    weight = 2.0;
    description = "URL uses backslashes";
    one_shot = true;
  }
  "URL_EXCESSIVE_DOTS" {
    weight = 2.0;
    description = "URL has excessive dots in hostname";
    one_shot = false;
  }
  "URL_VERY_LONG" {
    weight = 1.5;
    description = "URL is very long";
    one_shot = false;
  }

# Query issues
  "URL_QUERY_MULTIPLE_URLS" {
    weight = 2.0;
    description = "URL query embeds more than one URL";
    one_shot = true;
  }
}

Cancel