Update Phishing TLD

This commit is contained in:
SukkaW 2024-05-27 08:55:25 +08:00
parent d5e8b83c60
commit f46547edba
2 changed files with 6 additions and 2 deletions

View File

@ -34,12 +34,14 @@ const BLACK_TLD = new Set([
'cricket', 'cricket',
'cyou', 'cyou',
'date', 'date',
'digital',
'download', 'download',
'faith', 'faith',
'fit', 'fit',
'fun', 'fun',
'ga', 'ga',
'gd', 'gd',
'gives',
'gq', 'gq',
'group', 'group',
'host', 'host',
@ -126,7 +128,7 @@ export const getPhishingDomains = (parentSpan: Span) => parentSpan.traceChild('g
} }
const tld = getPublicSuffix(safeGorhillLine, looseTldtsOpt); const tld = getPublicSuffix(safeGorhillLine, looseTldtsOpt);
if (!tld || !BLACK_TLD.has(tld)) continue; if (!tld || (!BLACK_TLD.has(tld) && tld.length < 7)) continue;
domainCountMap[apexDomain] ||= 0; domainCountMap[apexDomain] ||= 0;
domainCountMap[apexDomain] += calcDomainAbuseScore(line); domainCountMap[apexDomain] += calcDomainAbuseScore(line);
@ -159,7 +161,8 @@ export function calcDomainAbuseScore(line: string) {
if (isPhishingDomainMockingCoJp) { if (isPhishingDomainMockingCoJp) {
weight += 4; weight += 4;
} }
} else if (line.includes('.customer')) { }
if (line.includes('.customer')) {
weight += 0.25; weight += 0.25;
} }

View File

@ -305,6 +305,7 @@ inst.360safe.com
.myenotice.com .myenotice.com
.eu5.net .eu5.net
.jdie.pl .jdie.pl
.lumindigitalhosting.com
# --- AD Block --- # --- AD Block ---