From 5301c1dec7964433afc2154f40fad384457ef1d5 Mon Sep 17 00:00:00 2001 From: Xerihet <50606433+Xerihet@users.noreply.github.com> Date: Thu, 16 Jul 2026 08:21:09 +1000 Subject: [PATCH 1/2] Update detection rules and remove domain squatting config Removed domain squatting detection configuration and added new URL patterns for detection. Signed-off-by: Xerihet <50606433+Xerihet@users.noreply.github.com> --- rules/detection-rules.json | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-) diff --git a/rules/detection-rules.json b/rules/detection-rules.json index ad01d82..c87a22c 100644 --- a/rules/detection-rules.json +++ b/rules/detection-rules.json @@ -60,7 +60,20 @@ "^https:\\/\\/(?:[^/]*\\.)?zoom\\.us(/.*)?$", "^https:\\/\\/github\\.com(/.*)?$", "^https:\\/\\/[^/]*\\.github\\.com(/.*)?$", - "^https:\\/\\/[^/]*\\.github\\.io(/.*)?$" + "^https:\\/\\/[^/]*\\.github\\.io(/.*)?$", + "^https://[^/]*\\.mycurricula\\.com(/.*)?$", + "^https://[^/]*\\.notificationservices\\.org(/.*)?$", + "^https://[^/]*\\.reddit\\.com(/.*)?$", + "^https://[^/]*\\.corestrengths\\.com(/.*)?$", + "^https://[^/]*\\.fs\\.com(/.*)?$", + "^https://[^/]*\\.halopsa\\.com(/.*)?$", + "^https://[^/]*\\.jotform\\.com(/.*)?$", + "^https://[^/]*\\.seagateciam\\.ciamlogin\\.com(/.*)?$", + "^https://[^/]*\\.lenovo\\.com(/.*)?$", + "^https://[^/]*\\.plumsail\\.com(/.*)?$", + "^https://[^/]*\\.app\\.vyond\\.com(/.*)?$", + "^https:\\/\\/[^/]*\\.zoho\\.com(/.*)?$", + "^https:\\/\\/[^/]*\\.zoho\\.com\\.au(/.*)?$" ], "context_indicators": { "description": "Additional context that indicates legitimate discussion vs phishing", @@ -2007,19 +2020,5 @@ "log_matches": true, "auto_update": true, "fallback_on_error": true - }, - "domain_squatting": { - "description": "Domain squatting detection configuration to protect against typosquatting, homoglyphs, and combosquatting attacks", - "action": "block", - "deviation_threshold": 2, - "algorithms": { - "levenshtein": true, - "homoglyph": true, - "typosquat": true, - "combosquat": true - }, - "protected_domains": [], - "severity": "high", - "log_detections": true } } From 4dc1604a53894ed51be24442193e6ffd7ff5e19b Mon Sep 17 00:00:00 2001 From: tina-m-CIT Date: Fri, 9 Oct 2026 12:48:23 +1000 Subject: [PATCH 2/2] added www.nine.com.au to domain_patterns --- rules/detection-rules.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rules/detection-rules.json b/rules/detection-rules.json index c87a22c..d84d1ea 100644 --- a/rules/detection-rules.json +++ b/rules/detection-rules.json @@ -73,7 +73,8 @@ "^https://[^/]*\\.plumsail\\.com(/.*)?$", "^https://[^/]*\\.app\\.vyond\\.com(/.*)?$", "^https:\\/\\/[^/]*\\.zoho\\.com(/.*)?$", - "^https:\\/\\/[^/]*\\.zoho\\.com\\.au(/.*)?$" + "^https:\\/\\/[^/]*\\.zoho\\.com\\.au(/.*)?$", + "^https:\\/\\/[^/]*\\.nine\\.com\\.au(/.*)?$" ], "context_indicators": { "description": "Additional context that indicates legitimate discussion vs phishing",