Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
260 lines (239 sloc) 4.11 KB
keywords = {
# Generic suspicious
'login': 25,
'log-in': 25,
'sign-in': 25,
'signin': 25,
'account': 25,
'verification': 25,
'verify': 25,
'webscr': 25,
'password': 25,
'credential': 25,
'support': 25,
'activity': 25,
'security': 25,
'update': 25,
'authentication': 25,
'authenticate': 25,
'authorize': 25,
'wallet': 25,
'alert': 25,
'purchase': 25,
'transaction': 25,
'recover': 25,
'unlock': 25,
'confirm': 20,
'live': 15,
'office': 15,
'service': 15,
'manage': 15,
'invoice': 15,
'secure': 10,
'customer': 10,
'client': 10,
'bill': 10,
'online': 10,
'safe': 10,
'form': 10,
'authorise': 25,
'swift': 25,
# Apple iCloud
'appleid': 70,
'icloud': 60,
'iforgot': 60,
'itunes': 50,
'apple': 30,
'applesupport': 50,
'imessage': 60,
# Email
'outlook': 60,
'office365': 50,
'microsoft': 60,
'windows': 30,
'protonmail': 70,
'tutanota': 60,
'hotmail': 60,
'gmail': 70,
'google': 70,
'outlook': 60,
'yahoo': 60,
'google': 60,
'yandex': 60,
'protonmail': 60,
'googlemail': 60,
# Social Media
'twitter': 60,
'facebook': 60,
'tumblr': 60,
'reddit': 60,
'youtube': 40, # some false positives
'linkedin': 60,
'instagram': 60,
'flickr': 60,
'whatsapp': 60,
'wire': 60,
'signal': 60,
'wechat': 60,
'weibo': 60,
'QQ': 60,
'Qzone': 60,
'discordapp': 60,
'telegram': 70,
# US Goverment
'Senate': 90,
'DNC': 70,
'Democrats': 80,
'GOP': 60,
'Republicans': 80,
# Cryptocurrency
'localbitcoin': 70,
'poloniex': 60,
'coinhive': 70,
'bithumb': 60,
'kraken': 50, # some false positives
'bitstamp': 60,
'bittrex': 60,
'blockchain': 70,
'bitflyer': 60,
'coinbase': 60,
'hitbtc': 60,
'lakebtc': 60,
'bitfinex': 60,
'bitconnect': 60,
'coinsbank': 60,
'Litecoin': 60,
'Ethereum': 60,
'Monero': 60,
'Zcash': 60,
# Bank/money
'paypal': 70,
'moneygram': 60,
'westernunion': 60,
'bankofamerica': 60,
'wellsfargo': 60,
'citigroup': 60,
'santander': 60,
'morganstanley': 60,
'barclays': 50,
'hsbc': 50,
'scottrade': 60,
'ameritrade': 60,
'merilledge': 60,
'bank': 15,
'rbs': 60,
'applePay': 50,
'barclays': 50,
'natwest': 50,
'squareup': 50,
'TSB': 70,
'Factures': 60,
'Zahlungserinnerung': 70,
'Rechnung': 60,
'Bezahlen': 50,
'Rechnungszahlung': 80,
# Ecommerce
'amazon': 60,
'overstock': 60,
'alibaba': 60,
'aliexpress': 60,
'leboncoin': 70,
'banggood':60,
# Other
'netflix': 70,
'skype': 60,
'github': 60,
'hmrc': 80,
'bit.ly':40, # experimental, may break things!
# Miscellaneous & SE tricks
'cgi-bin': 50,
'.com-': 20,
'-com.': 20,
'.net-': 20,
'.org-': 20,
'.com-': 20,
'.net.': 20,
'.org.': 20,
'.com.': 20,
'.gov-': 30,
'.gov.': 30,
'.gouv-': 40,
'-gouv-': 40,
'.gouv.': 40,
}
tlds = [
'.ga',
'.gq',
'.ml',
'.cf',
'.tk',
'.xyz',
'.pw',
'.cc',
'.club',
'.work',
'.top',
'.support',
'.bank',
'.info',
'.study',
'.party',
'.click',
'.country',
'.stream',
'.gdn',
'.mom',
'.xin',
'.kim',
'.men',
'.loan',
'.download',
'.racing',
'.online',
'.center',
'.ren',
'.gb',
'.win',
'.review',
'.vip',
'.party',
'.tech',
'.science',
'.business',
'.press',
'.reise',
'.accountant',
'.cricket',
'.yokahama',
'.sale',
'.host',
'.faith',
'.link',
'.bid',
'.webcam',
'.agency',
'.schule',
'.km',
'.rw',
'.faith',
'.cw',
'.today',
'.zm',
'.fi',
'.trade',
'.live',
'.world',
'.ki',
'.nf',
'.sx',
'.so',
'.sc',
'.tj',
'.ug',
'.to',
'.sh',
'.rent',
'.ms',
'.mu',
'.biz'
]