---
name: "Mail::SpamAssassin::Plugin::Phishing"
section: "3pm"
platform: "linux"
package: "spamassassin"
version: "4.0.2-3"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/Mail::SpamAssassin::Plugin::Phishing"
---

# Mail::SpamAssassin::Plugin::Phishing(3pm)

check uris against phishing feed

## NAME

Mail::SpamAssassin::Plugin::Phishing - check uris against phishing feed

## SYNOPSIS

```
  loadplugin Mail::SpamAssassin::Plugin::Phishing
  ifplugin Mail::SpamAssassin::Plugin::Phishing
    phishing_openphish_feed /etc/mail/spamassassin/openphish-feed.txt
    phishing_phishtank_feed /etc/mail/spamassassin/phishtank-feed.csv
    phishing_phishstats_feed /etc/mail/spamassassin/phishstats-feed.csv
    phishing_phishing_database_feed /etc/mail/spamassassin/phishing-database-feed.csv
    body     URI_PHISHING      eval:check_phishing()
    describe URI_PHISHING      Url match phishing in feed
  endif
```

## DESCRIPTION

This plugin finds uris used in phishing campaigns detected by OpenPhish, PhishTank or PhishStats feeds.

The Openphish free feed is updated every 6 hours and can be downloaded from https://openphish.com/feed.txt.

The PhishTank free feed is updated every 1 hours and can be downloaded from http://data.phishtank.com/data/online-valid.csv. To avoid download limits a registration is required.

The PhishStats feed is updated every 90 minutes and can be downloaded from https://phishstats.info/phish\_score.csv.

The Phishing Database feed is updated every few hours and can be downloaded from https://phish.co.za/latest/phishing-links-ACTIVE.txt

## ADMIN PREFERENCES

The following options can be used in site-wide (`"local.cf"`) configuration files to customize how the module handles phishing uris

- phishing\_openphish\_feed

  Absolute path of the downloaded OpenPhish datafeed.

- phishing\_phishtank\_feed

  Absolute path of the downloaded PhishTank datafeed.

- phishing\_uri\_noparam ( 0 \| 1 ) (default: 0)

  If this option is set uri parameters will not be take into consideration when parsing the phishing uris datafeed. If this option is enabled and the url without parameters has no subdirectories (like https://www.kisa.link/url\_redirector.php?url=...) the url will be skipped.

- phishing\_phishstats\_feed

  Absolute path of the downloaded PhishStats datafeed.

- phishing\_phishstats\_minscore ( 0 - 10 ) (default: 6)

  Minimum score to take into consideration for phishing uris downloaded from PhishStats datafeed.

- phishing\_phishing\_database\_feed

  Absolute path of the downloaded Phishing Database datafeed.

## ADMIN PREFERENCES

The following options can be used in site-wide (`"local.cf"`) configuration files to customize how the module handles phishing uris