Mail::...ishing(3pm)

🎀 Mail::...ishing 🎀

okay bestie, this is a page from the User Contributed Perl Documentation for Mail::SpamAssassin::Plugin::Phishing (yes that name got squished with dots, that's just the short header vibe, the real name is down below 💖). Pull up a chair, grab a boba, we're doing phishing feed checks.

---

✨ NAME ✨

Mail::SpamAssassin::Plugin::Phishing — check uris against phishing feed 🎣

---

🌸 SYNOPSIS 🌸

the way you just drop this into your config and it goes, no cap:

loadplugin Mail::SpamAssassin::Plugin::Phishing

ifplugin Mail::SpamAssassin::Plugin::Phishing
  phishing_openphish_feed /etc/spamassassin/openphish-feed.txt
  phishing_phishtank_feed /etc/spamassassin/phishtank-feed.csv
  phishing_phishstats_feed /etc/spamassassin/phishstats-feed.csv
  phishing_phishing_database_feed /etc/spamassassin/phishing-database-feed.csv
  body     URI_PHISHING      eval:check_phishing()
  describe URI_PHISHING      Url match phishing in feed
endif

---

🦋 DESCRIPTION 🦋

so what does this plugin do? it finds uris that are being used in phishing campaigns — the ones detected by the OpenPhish, PhishTank or PhishStats feeds. literally its whole main character job 💅

here's the tea on each feed:

• Openphish — the free feed gets updated every 6 hours, and you can download it from https://openphish.com/feed.txt ✨
• PhishTank — the free feed gets updated every 1 hours (yes bestie, "1 hours", we don't make the rules), and you can grab it from http://data.phishtank.com/data/online-valid.csv. heads up tho: to avoid download limits, a registration is required 🔑
• PhishStats — updated every 90 minutes, downloadable from https://phishstats.info/phish_score.csv 📈
• Phishing Database — updated every few hours, downloadable from https://phish.co.za/latest/phishing-links-ACTIVE.txt 🗂️

---

👑 ADMIN PREFERENCES 👑

these options go in your site-wide config files (local.cf) to customize how the module handles phishing uris 🫶

• phishing_openphish_feed — absolute path of the downloaded OpenPhish datafeed. 📁
• phishing_phishtank_feed — absolute path of the downloaded PhishTank datafeed. 📁
• phishing_uri_noparam ( 0 | 1 ) (default: 0) — if this one's set, uri parameters will not be taken into consideration when parsing the phishing uris datafeed. and listen: if this option is enabled and the url without parameters has no subdirectories (like https://www.kisa.link/url_redirector.php?url=...), the url will be skipped. lowkey important, don't skip over it 🙈
• phishing_phishstats_feed — absolute path of the downloaded PhishStats datafeed. 📁
• phishing_phishstats_minscore ( 0 - 10 ) (default: 6) — the minimum score to take into consideration for phishing uris downloaded from the PhishStats datafeed. ⭐
• phishing_phishing_database_feed — absolute path of the downloaded Phishing Database datafeed. 📁

---

💜 ADMIN PREFERENCES 💜

(not a typo bestie, the page really says it twice — iconic of it tbh, we love a repeat 🎀)

these options go in your site-wide config files (local.cf) to customize how the module handles phishing uris 💅

---

that's the whole thing, no notes 👑

sending you off with the receipts: this one's running on perl v5.40.1, dated 2026-07-23, filed under Mail::...ishing(3pm). periodt. 💖✨🦋