|
@@ -34,12 +34,14 @@ const BLACK_TLD = new Set([
|
|
|
'cricket',
|
|
'cricket',
|
|
|
'cyou',
|
|
'cyou',
|
|
|
'date',
|
|
'date',
|
|
|
|
|
+ 'digital',
|
|
|
'download',
|
|
'download',
|
|
|
'faith',
|
|
'faith',
|
|
|
'fit',
|
|
'fit',
|
|
|
'fun',
|
|
'fun',
|
|
|
'ga',
|
|
'ga',
|
|
|
'gd',
|
|
'gd',
|
|
|
|
|
+ 'gives',
|
|
|
'gq',
|
|
'gq',
|
|
|
'group',
|
|
'group',
|
|
|
'host',
|
|
'host',
|
|
@@ -126,7 +128,7 @@ export const getPhishingDomains = (parentSpan: Span) => parentSpan.traceChild('g
|
|
|
}
|
|
}
|
|
|
|
|
|
|
|
const tld = getPublicSuffix(safeGorhillLine, looseTldtsOpt);
|
|
const tld = getPublicSuffix(safeGorhillLine, looseTldtsOpt);
|
|
|
- if (!tld || !BLACK_TLD.has(tld)) continue;
|
|
|
|
|
|
|
+ if (!tld || (!BLACK_TLD.has(tld) && tld.length < 7)) continue;
|
|
|
|
|
|
|
|
domainCountMap[apexDomain] ||= 0;
|
|
domainCountMap[apexDomain] ||= 0;
|
|
|
domainCountMap[apexDomain] += calcDomainAbuseScore(line);
|
|
domainCountMap[apexDomain] += calcDomainAbuseScore(line);
|
|
@@ -159,7 +161,8 @@ export function calcDomainAbuseScore(line: string) {
|
|
|
if (isPhishingDomainMockingCoJp) {
|
|
if (isPhishingDomainMockingCoJp) {
|
|
|
weight += 4;
|
|
weight += 4;
|
|
|
}
|
|
}
|
|
|
- } else if (line.includes('.customer')) {
|
|
|
|
|
|
|
+ }
|
|
|
|
|
+ if (line.includes('.customer')) {
|
|
|
weight += 0.25;
|
|
weight += 0.25;
|
|
|
}
|
|
}
|
|
|
|
|
|