Last active
August 30, 2022 13:46
-
-
Save gwire/9c251e8f06e4484fae197ee08e5caf23 to your computer and use it in GitHub Desktop.
SpamAssassin rule to match IPFS urls
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
## these are the IPFS gateways I've seen most frequently in spam/phishing. | |
## Others can be found via https://ipfs.github.io/public-gateway-checker/ | |
## We assume the string "/ipfs/" followed by a Base36/Base32 string of at least 20 chars is an IPFS url. | |
uri __URI_IPFS_LIKELY m,/ipfs/[a-z0-9]{20,}=?,i | |
uri __URI_IPFS_1 m,://ipfs.io/ipfs/,i | |
uri __URI_IPFS_2 m,://ipfs.fleek.co/ipfs/,i | |
meta HEX_IPFS_URI ( __URI_IPFS_1 || __URI_IPFS_2 ) | |
describe HEX_IPFS_URI Contains a known IPFS public gateway URI | |
score HEX_IPFS_URI 1.0 | |
meta HEX_IPFS_LIKELY __URI_IPFS_LIKELY && !HEX_IPFS_URI | |
describe HEX_IPFS_LIKELY Probably contains an IPFS public gateway URI | |
score HEX_IPFS_LIKELY 0.2 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment