[Minor] Attach domain part to `R_SUSPICIOUS_URL`

2 files changed, 10 insertions, 9 deletions

diff --git a/conf/metrics.conf b/conf/metrics.conf
index 96304725b..634a6f698 100644
--- a/conf/metrics.conf
+++ b/conf/metrics.conf
@@ -1002,6 +1002,13 @@ metric {
             one_shot = true;
         }
     }
+    group "url" {
+        symbol "R_SUSPICIOUS_URL" {
+            weight = 6.0;
+            description = "Obfusicated or suspicious URL has been found in a message";
+            one_shot = true;
+        }
+    }
 
     .include(try=true; priority=1) "$LOCAL_CONFDIR/local.d/metrics.conf"
     .include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/metrics.conf"
diff --git a/rules/misc.lua b/rules/misc.lua
index 87687720a..b3926e46b 100644
--- a/rules/misc.lua
+++ b/rules/misc.lua
@@ -83,24 +83,18 @@ rspamd_config.DATE_IN_PAST = function(task)
 	return false
 end
 
-rspamd_config.R_SUSPICIOUS_URL = {
-  callback = function(task)
+rspamd_config.R_SUSPICIOUS_URL = function(task)
     local urls = task:get_urls()
 
     if urls then
       for i,u in ipairs(urls) do
         if u:is_obscured() then
-          return true
+          task:insert_result('R_SUSPICIOUS_URL', 1.0, u:get_host())
         end
       end
     end
     return false
-  end,
-  score = 6.0,
-  group = 'url',
-  one_shot = true,
-  description = 'Obfusicated or suspicious URL has been found in a message'
-}
+end
 
 rspamd_config.SUBJ_ALL_CAPS = {
   callback = function(task)