rspamd - openphish support

[Ralph]

Code: Select all

nano  /etc/rspamd/local.d/phishing.conf
# add

# Enable openphish support (default disabled)
openphish_enabled = true;
# URL of feed, default is public url:
openphish_map = "https://raw.githubusercontent.com/openphish/public_feed/refs/heads/main/feed.txt";
# For premium feed, change that to your personal URL, e.g.
# openphish_map = "https://openphish.com/samples/premium_feed.json";
# Change this to true if premium feed is enabled
openphish_premium = false;

generic_service_enabled = true;
generic_service_name = 'Phishing.Database';
generic_service_symbol = "PHISHING_DATABASE";
generic_service_map = "https://raw.githubusercontent.com/Phishing-Database/Phishing.Database/refs/heads/master/phishing-links-ACTIVE.txt";

Code: Select all

nano /etc/rspamd/local.d/phishing_group.conf
# add

symbols {
    "PHISHING_DATABASE" {
        weight = 5.0;
        description = "Phishing URL listed in Phishing.Database";
        one_shot = true;
    }
}

Code: Select all

touch /etc/rspamd/local.d/phishing_whitelist.inc

Code: Select all

systemctl restart rspamd
systemctl status rspamd
cat /var/log/rspamd/rspamd.log | grep phishing

Phishing Database - maps:
https://github.com/Phishing-Database/Phishing.Database