From 9623db462a5ea466574a975bdc28fae1e9df9549 Mon Sep 17 00:00:00 2001 From: Martyn Greville-Giddings <19636691+martyn-gg@users.noreply.github.com> Date: Thu, 5 Nov 2026 14:58:31 +0000 Subject: [PATCH] Exclude britishgas.co.uk from detection British Gas customer sign-in (identity.auth.britishgas.co.uk) is hosted on Microsoft Entra External ID / B2C, so the page carries Microsoft login markup and is scored as an M365 look-alike. Blocked 05/11/2026 14:50 with a legitimacy score of 17/85 and one indicator (phi_021_suspicious_url_structure, triggered by the tenant GUID in the path). Adds britishgas.co.uk and its subdomains to exclusion_system.domain_patterns. The pattern is anchored on the origin, so britishgas.co.uk.evil.com and britishgas.co.uk-login.com still fall through to detection. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01J5UjQK67SyYd1Byh1iLEG8 --- rules/detection-rules.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rules/detection-rules.json b/rules/detection-rules.json index ad01d827..575fcacf 100644 --- a/rules/detection-rules.json +++ b/rules/detection-rules.json @@ -60,7 +60,8 @@ "^https:\\/\\/(?:[^/]*\\.)?zoom\\.us(/.*)?$", "^https:\\/\\/github\\.com(/.*)?$", "^https:\\/\\/[^/]*\\.github\\.com(/.*)?$", - "^https:\\/\\/[^/]*\\.github\\.io(/.*)?$" + "^https:\\/\\/[^/]*\\.github\\.io(/.*)?$", + "^https:\\/\\/(?:[^/]*\\.)?britishgas\\.co\\.uk(/.*)?$" ], "context_indicators": { "description": "Additional context that indicates legitimate discussion vs phishing",