Add support for Spamassassin phishing and EBL module
Starting from version 3.4.2 of Spamassassin there are two new useful modules: phishing (using OpenPhish or PhishTank) and HashBL/EBL (Email Blocklist) modules. On a Debian 10 installation I have successful enabled the phishing module with both phish repositories by adding in /etc/spamassassin/local.cf
ifplugin Mail::SpamAssassin::Plugin::Phishing
phishing_openphish_feed /etc/mail/spamassassin/openphish-feed.txt
phishing_phishtank_feed /etc/mail/spamassassin/phishtank-feed.csv
body URI_PHISHING eval:check_phishing()
describe URI_PHISHING Url match phishing in feed
endif
I have then added a cron that runs hourly for updates the signatures
#!/bin/bash
curl -L https://openphish.com/feed.txt -z /etc/mail/spamassassin/openphish-feed.txt -o /etc/mail/spamassassin/openphish-feed.txt &> /dev/null
curl -L http://data.phishtank.com/data/online-valid.csv -z /etc/mail/spamassassin/phishtank-feed.csv -o /etc/mail/spamassassin/phishtank-feed.csv &> /dev/null
Would be nice to have these features in the next ISPConfig release