Re: Phishing Safe Sites

Shawn Iverson via MailScanner <mailscanner-qhrM8SXbD5JTOyd/[email protected]> Mon, 4 Nov 2024 12:14:39 -0500
Newsgroups gmane.mail.virus.mailscanner
Message-ID <[email protected]>
This is a multi-part message in MIME format.
--===============0431120071483913764==
Content-Type: multipart/alternative;
 boundary="------------CM3byY3NOLVMTHJJ3e2Aon3D"
Content-Language: en-US

This is a multi-part message in MIME format.
--------------CM3byY3NOLVMTHJJ3e2Aon3D
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

drive.google.com seems to be a complaint I sometimes receive on the 
MailScanner project because it often shows up in Phishtank, and it only 
takes one bad URL reported to Phishtank to cause the entire 
drive.google.com to get flagged as a bad site.

On 11/4/24 11:52, Jerry Benton wrote:
>
> I was reviewing the build script for the safe and bad sites today.
>
>   * The safe sites file will contain the top 1500 domains on the
>     internet. This will pretty much be static as AWS no longer
>     publishes that information. It will be updated in the next 4
>     hours. (Currently empty.)
>   * The bad sites file is still updated every 4 hours from phishtank
>     with the latest nefarious sites.
>   * The safe domains used while building the script are below. If you
>     have any suggestions to add to that list, let me know. No, I will
>     not add your personal domain. You can use the custom safe sites
>     list in MailScanner for that.
>
> # common short url providers
>
> $safe_domains[] = 'adf.ly';
>
> $safe_domains[] = 'bit.ly';
>
> $safe_domains[] = 'doiop.com';
>
> $safe_domains[] = 'fur.ly';
>
> $safe_domains[] = 'goo.gl';
>
> $safe_domains[] = 'is.gd';
>
> $safe_domains[] = 'mcaf.ee';
>
> $safe_domains[] = 'ow.ly';
>
> $safe_domains[] = 'snipurl.com';
>
> $safe_domains[] = 'su.pr';
>
> $safe_domains[] = 'tinyurl.com';
>
> $safe_domains[] = 'v.gd';
>
> $safe_domains[] = 'tiny.cc';
>
> $safe_domains[] = 'tr.im';
>
> $safe_domains[] = 'bit.do';
>
> $safe_domains[] = 'po.st';
>
> $safe_domains[] = 'lrd.to';
>
> $safe_domains[] = 'g.co';
>
> # known safe domains
>
> $safe_domains[] = 'www.google.com';
>
> $safe_domains[] = 'docs.google.com';
>
> $safe_domains[] = 'accounts.google.com';
>
> $safe_domains[] = 'sites.google.com';
>
> $safe_domains[] = 'mail.google.com';
>
> $safe_domains[] = 'schema.org';
>
> $safe_domains[] = 'urldefense.proofpoint.com';
>
> -- 
>
> Jerry Benton
>
> www.mailborder.com <http://www.mailborder.com>
>
> +1 843-800-8605
>
>
>
--------------CM3byY3NOLVMTHJJ3e2Aon3D
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">drive.google.com seems to be a
      complaint I sometimes receive on the MailScanner project because
      it often shows up in Phishtank, and it only takes one bad URL
      reported to Phishtank to cause the entire drive.google.com to get
      flagged as a bad site.</div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">On 11/4/24 11:52, Jerry Benton wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:DS7PR12MB8372D0F7E94AAB591A48C3B3F4512-2rwrlj3xeO1DPS5gJ4XbBQdYzm3356FpvxpqHgZTriW3zl9H0oFU5g@public.gmane.org">
      <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
      <meta name="Generator"
        content="Microsoft Word 15 (filtered medium)">
      <style>@font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}@font-face
	{font-family:Aptos;
	panose-1:2 11 0 4 2 2 2 2 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	font-size:11.0pt;
	font-family:"Aptos",sans-serif;}p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
	{mso-style-priority:34;
	margin-top:0in;
	margin-right:0in;
	margin-bottom:0in;
	margin-left:.5in;
	font-size:11.0pt;
	font-family:"Aptos",sans-serif;}span.EmailStyle17
	{mso-style-type:personal-compose;
	font-family:"Aptos",sans-serif;
	color:windowtext;}.MsoChpDefault
	{mso-style-type:export-only;
	font-size:11.0pt;
	mso-ligatures:none;}div.WordSection1
	{page:WordSection1;}ol
	{margin-bottom:0in;}ul
	{margin-bottom:0in;}</style>
      <div class="WordSection1">
        <p class="MsoNormal">I was reviewing the build script for the
          safe and bad sites today.
          <o:p></o:p></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <ul style="margin-top:0in" type="disc">
          <li class="MsoListParagraph"
            style="margin-left:0in;mso-list:l0 level1 lfo1">The safe
            sites file will contain the top 1500 domains on the
            internet. This will pretty much be static as AWS no longer
            publishes that information. It will be updated in the next 4
            hours. (Currently empty.)<o:p></o:p></li>
          <li class="MsoListParagraph"
            style="margin-left:0in;mso-list:l0 level1 lfo1">The bad
            sites file is still updated every 4 hours from phishtank
            with the latest nefarious sites.
            <o:p></o:p></li>
          <li class="MsoListParagraph"
            style="margin-left:0in;mso-list:l0 level1 lfo1">The safe
            domains used while building the script are below. If you
            have any suggestions to add to that list, let me know. No, I
            will not add your personal domain. You can use the custom
            safe sites list in MailScanner for that. <o:p></o:p></li>
        </ul>
        <p class="MsoNormal"><o:p> </o:p></p>
        <p class="MsoNormal"># common short url providers<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'adf.ly';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'bit.ly';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'doiop.com';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'fur.ly';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'goo.gl';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'is.gd';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'mcaf.ee';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'ow.ly';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'snipurl.com';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'su.pr';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'tinyurl.com';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'v.gd';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'tiny.cc';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'tr.im';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'bit.do';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'po.st';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'lrd.to';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'g.co';<o:p></o:p></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <p class="MsoNormal"># known safe domains<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = '<a class="moz-txt-link-abbreviated" href="http://www.google.com">www.google.com</a>';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'docs.google.com';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'accounts.google.com';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'sites.google.com';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'mail.google.com';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] = 'schema.org';<o:p></o:p></p>
        <p class="MsoNormal">$safe_domains[] =
          'urldefense.proofpoint.com';<o:p></o:p></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <div>
          <div>
            <p class="MsoNormal"><span
                style="font-family:&quot;Calibri&quot;,sans-serif"><o:p> </o:p></span></p>
            <p class="MsoNormal"><span
                style="font-family:&quot;Calibri&quot;,sans-serif">-- <o:p></o:p></span></p>
            <p class="MsoNormal"><span
                style="font-family:&quot;Calibri&quot;,sans-serif">Jerry
                Benton<o:p></o:p></span></p>
            <p class="MsoNormal"><span
                style="font-family:&quot;Calibri&quot;,sans-serif"><a
                  href="http://www.mailborder.com"
                  moz-do-not-send="true"><span style="color:#0563C1">www.mailborder.com</span></a><o:p></o:p></span></p>
            <p class="MsoNormal"><span
                style="font-family:&quot;Calibri&quot;,sans-serif">+1
                843-800-8605<o:p></o:p></span></p>
          </div>
        </div>
        <p class="MsoNormal"><o:p> </o:p></p>
      </div>
      <br>
      <fieldset class="moz-mime-attachment-header"></fieldset>
      <pre class="moz-quote-pre" wrap="">

</pre>
    </blockquote>
  </body>
</html>

--------------CM3byY3NOLVMTHJJ3e2Aon3D--

--===============0431120071483913764==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline



-- 
MailScanner mailing list
mailscanner-qhrM8SXbD5JTOyd/[email protected]
http://lists.mailscanner.info/mailman/listinfo/mailscanner


--===============0431120071483913764==--