Skip to content

Instantly share code, notes, and snippets.

@gwire
Last active August 30, 2022 13:46
Show Gist options
  • Save gwire/9c251e8f06e4484fae197ee08e5caf23 to your computer and use it in GitHub Desktop.
Save gwire/9c251e8f06e4484fae197ee08e5caf23 to your computer and use it in GitHub Desktop.
SpamAssassin rule to match IPFS urls
## these are the IPFS gateways I've seen most frequently in spam/phishing.
## Others can be found via https://ipfs.github.io/public-gateway-checker/
## We assume the string "/ipfs/" followed by a Base36/Base32 string of at least 20 chars is an IPFS url.
uri __URI_IPFS_LIKELY m,/ipfs/[a-z0-9]{20,}=?,i
uri __URI_IPFS_1 m,://ipfs.io/ipfs/,i
uri __URI_IPFS_2 m,://ipfs.fleek.co/ipfs/,i
meta HEX_IPFS_URI ( __URI_IPFS_1 || __URI_IPFS_2 )
describe HEX_IPFS_URI Contains a known IPFS public gateway URI
score HEX_IPFS_URI 1.0
meta HEX_IPFS_LIKELY __URI_IPFS_LIKELY && !HEX_IPFS_URI
describe HEX_IPFS_LIKELY Probably contains an IPFS public gateway URI
score HEX_IPFS_LIKELY 0.2
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment