https://github.com/lstep/rspamd-url-behaviour-extension
Goal of this project is to implement an extension for RSPAMd that is capable of examining all the urls in an email
https://github.com/lstep/rspamd-url-behaviour-extension
rspamd rspamd-plugin security spam-detection
Last synced: about 1 year ago
JSON representation
Goal of this project is to implement an extension for RSPAMd that is capable of examining all the urls in an email
- Host: GitHub
- URL: https://github.com/lstep/rspamd-url-behaviour-extension
- Owner: lstep
- License: gpl-3.0
- Created: 2024-03-20T08:53:41.000Z (over 2 years ago)
- Default Branch: main
- Last Pushed: 2024-08-08T08:21:29.000Z (almost 2 years ago)
- Last Synced: 2025-02-06T22:31:32.947Z (over 1 year ago)
- Topics: rspamd, rspamd-plugin, security, spam-detection
- Language: Go
- Homepage:
- Size: 23.4 KB
- Stars: 0
- Watchers: 2
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# URL Behaviour extension for RSPAMd
Goal of this project is to implement an extension for RSPAMd that is capable of examining all the urls in an email with the following features:
- [ ] ML analysis of the presented url (ultra long url, domains, subdomains, known fake name one lowest subdomain (paypal, etc))
- [ ] Analysis of the domain + SSL
- known in blacklist/reputation ? (original and final redirected)
- Use 1 million Alexa top ranking (dead?)
- Use Cisco Umbrella (https://s3-us-west-1.amazonaws.com/umbrella-static/index.html)
- Majestic million (https://downloads.majesticseo.com/majestic_million.csv)
- when registered + SSL cert creation?
- [ ] Check for redirections, and if too many (> 2 for example), will trigger
- [ ] send url to a sandbox and examine its content (AI, visual check)
- [ ] Analysis of the final page:
- number of broken links
- AI analysis of visual representation
- Check the Domain Age and Ownership (whois search)
- Check SSL certificate origin (and date creation)
# References
- Jeffry Sleddens's rspamd plugin: https://github.com/jeffrysleddens/rspamd-bitcoinabuse-plugin
- SwissCenter made or modded plugins for rspamd: https://github.com/sriccio/rspamd-plugins
- Phishing URL Detection with ML: https://towardsdatascience.com/phishing-domain-detection-with-ml-5be9c99293e5