loadplugin     PhishTag PhishTag.pm

trigger_ratio	   0.01


#scripting related keywords from http://www.w3.org/TR/html401/interact/scripts.html
rawbody      __HAS_SCRIPT /<SCRIPT|on((un)?load|(dbl)?click|mouse(down|up|over|move|out)|blur|key(press|down|up)|submit|reset|select|change)/i


#This trigger will match non-scripted emails that contain a URL in the
#URIBL blacklist, and also has a ip URL which has a non-ip anchor
#text; a common signature for phishing emails.
#If this trigger goes off, all the URLs will be rewritten to point to
#the consumer education page of the Anti-Phishing Working Group.

meta      HARD_URL (( URIBL_BLACK && ! __HAS_SCRIPT) && (HTTPS_IP_MISMATCH))
score	  HARD_URL 0
trigger_target	   HARD_URL	http://www.antiphishing.org/consumer_recs.html


#Another trick used by phishers is to use a subdomain name that 
#corresponds to a legitimate company domain name, hence creates
#trust to the untrained eye.
#If this trigger goes off, all the URLs will be rewritten to point to
#the consumer education page of the Anti-Phishing Working Group.

meta	  EASY_URL (( URIBL_BLACK && ! __HAS_SCRIPT) && (SPOOF_COM2COM || SPOOF_NET2COM))
score	  EASY_URL 0
trigger_target	   EASY_URL	http://www.antiphishing.org/consumer_recs.html



#URI_PH_SURBL
#HTTPS_IP_MISMATCH
#NORMAL_HTTP_TO_IP
#IP_LINK_PLUS
#SPOOF_COM2OTH
#SPOOF_COM2COM
#SPOOF_NET2COM
#FB_GAPPY_ADDRESS
#WEIRD_PORT
#HTTP_EXCESSIVE_ESCAPES
#NUMERIC_HTTP_ADDR
#HTTPS_HTTP_MISMATCH
#HIGH_CODEPAGE_URI
#HTTP_ESCAPED_HOST
#URI_HEX

#trigger_config   PhishTag.config