From c277ea43a7250eaafe773758af9cd7b486229b9b Mon Sep 17 00:00:00 2001
From: cccs-kevin <kevin.hardy-cooper@cyber.gc.ca>
Date: Fri, 14 Jun 2024 16:18:10 +0000
Subject: [PATCH] Removing terms in phishing post signatures that were causing
 false positives

---
 signatures/phishing.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/signatures/phishing.py b/signatures/phishing.py
index f67f9248..a9c71295 100644
--- a/signatures/phishing.py
+++ b/signatures/phishing.py
@@ -136,7 +136,7 @@ def process_output(self, output):
                     "T3R0YXdh",
                     "b3R0YXdh",
                     # Canada + Canada b64'd + canada b64'd
-                    "Canada",
+                    # "Canada", Removed due to FPs
                     "Q2FuYWRh",
                     "Y2FuYWRh",
                     # 1A1 A1A + 1A1 A1A b64'd + 1a1 a1a b64'd
@@ -192,8 +192,8 @@ def process_output(self, output):
                 "method": ANY,
                 "indicators": [
                     "maiden",
-                    "expiry",
-                    "billing",
+                    # "expiry", Removed due to FPs
+                    # "billing", Removed due to FPs
                 ],
             },
         ]