Re: Phishing Safe Sites
"Jerry Benton" <jerry.benton-OT/[email protected]> Mon, 4 Nov 2024 18:04:33 +0000
| Newsgroups | gmane.mail.virus.mailscanner |
|---|---|
| Message-ID | <DS7PR12MB8372223AEDD89870A58652EAF4512@DS7PR12MB8372.namprd12.prod.outlook.com> |
--===============8999234145098146407== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_DS7PR12MB8372223AEDD89870A58652EAF4512DS7PR12MB8372namp_" --_000_DS7PR12MB8372223AEDD89870A58652EAF4512DS7PR12MB8372namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Ok, I added drive.google.com. -- Jerry Benton www.mailborder.com<http://www.mailborder.com> +1 843-800-8605 From: MailScanner <mailscanner-bounces+jerry.benton=3Dmailborder.com@lists.= mailscanner.info> on behalf of Shawn Iverson via MailScanner <mailscanner@l= ists.mailscanner.info> Date: Monday, November 4, 2024 at 12:15 To: mailscanner-qhrM8SXbD5JTOyd/[email protected] <mailscanner-qhrM8SXbD5JTOyd/[email protected]> Cc: Shawn Iverson <[email protected]> Subject: Re: Phishing Safe Sites drive.google.com seems to be a complaint I sometimes receive on the MailSca= nner project because it often shows up in Phishtank, and it only takes one = bad URL reported to Phishtank to cause the entire drive.google.com to get f= lagged as a bad site. On 11/4/24 11:52, Jerry Benton wrote: I was reviewing the build script for the safe and bad sites today. * The safe sites file will contain the top 1500 domains on the internet= . This will pretty much be static as AWS no longer publishes that informati= on. It will be updated in the next 4 hours. (Currently empty.) * The bad sites file is still updated every 4 hours from phishtank with= the latest nefarious sites. * The safe domains used while building the script are below. If you hav= e any suggestions to add to that list, let me know. No, I will not add your= personal domain. You can use the custom safe sites list in MailScanner for= that. # common short url providers $safe_domains[] =3D 'adf.ly'; $safe_domains[] =3D 'bit.ly'; $safe_domains[] =3D 'doiop.com'; $safe_domains[] =3D 'fur.ly'; $safe_domains[] =3D 'goo.gl'; $safe_domains[] =3D 'is.gd'; $safe_domains[] =3D 'mcaf.ee'; $safe_domains[] =3D 'ow.ly'; $safe_domains[] =3D 'snipurl.com'; $safe_domains[] =3D 'su.pr'; $safe_domains[] =3D 'tinyurl.com'; $safe_domains[] =3D 'v.gd'; $safe_domains[] =3D 'tiny.cc'; $safe_domains[] =3D 'tr.im'; $safe_domains[] =3D 'bit.do'; $safe_domains[] =3D 'po.st'; $safe_domains[] =3D 'lrd.to'; $safe_domains[] =3D 'g.co'; # known safe domains $safe_domains[] =3D 'www.google.com<http://www.google.com>'; $safe_domains[] =3D 'docs.google.com'; $safe_domains[] =3D 'accounts.google.com'; $safe_domains[] =3D 'sites.google.com'; $safe_domains[] =3D 'mail.google.com'; $safe_domains[] =3D 'schema.org'; $safe_domains[] =3D 'urldefense.proofpoint.com'; -- Jerry Benton www.mailborder.com<http://www.mailborder.com> +1 843-800-8605 --_000_DS7PR12MB8372223AEDD89870A58652EAF4512DS7PR12MB8372namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:o=3D"urn:schemas-microsoft-com:office:office" xmlns:w=3D"urn:sc= hemas-microsoft-com:office:word" xmlns:m=3D"http://schemas.microsoft.com/of= fice/2004/12/omml" xmlns=3D"http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Aptos; panose-1:2 11 0 4 2 2 2 2 2 4;} @font-face {font-family:Consolas; panose-1:2 11 6 9 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; font-size:11.0pt; font-family:"Aptos",sans-serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} pre {mso-style-priority:99; mso-style-link:"HTML Preformatted Char"; margin:0in; margin-bottom:.0001pt; font-size:10.0pt; font-family:"Courier New";} p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph {mso-style-priority:34; margin-top:0in; margin-right:0in; margin-bottom:0in; margin-left:.5in; font-size:11.0pt; font-family:"Aptos",sans-serif;} span.HTMLPreformattedChar {mso-style-name:"HTML Preformatted Char"; mso-style-priority:99; mso-style-link:"HTML Preformatted"; font-family:"Consolas",serif;} span.EmailStyle23 {mso-style-type:personal-reply; font-family:"Aptos",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt; mso-ligatures:none;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} /* List Definitions */ @list l0 {mso-list-id:41710072; mso-list-template-ids:511206186;} @list l0:level1 {mso-level-number-format:bullet; mso-level-text:\F0B7 ; mso-level-tab-stop:.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level2 {mso-level-number-format:bullet; mso-level-text:\F0B7 ; mso-level-tab-stop:1.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level3 {mso-level-number-format:bullet; mso-level-text:\F0B7 ; mso-level-tab-stop:1.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level4 {mso-level-number-format:bullet; mso-level-text:\F0B7 ; mso-level-tab-stop:2.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level5 {mso-level-number-format:bullet; mso-level-text:\F0B7 ; mso-level-tab-stop:2.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level6 {mso-level-number-format:bullet; mso-level-text:\F0B7 ; mso-level-tab-stop:3.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level7 {mso-level-number-format:bullet; mso-level-text:\F0B7 ; mso-level-tab-stop:3.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level8 {mso-level-number-format:bullet; mso-level-text:\F0B7 ; mso-level-tab-stop:4.0in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} @list l0:level9 {mso-level-number-format:bullet; mso-level-text:\F0B7 ; mso-level-tab-stop:4.5in; mso-level-number-position:left; text-indent:-.25in; mso-ansi-font-size:10.0pt; font-family:Symbol;} ol {margin-bottom:0in;} ul {margin-bottom:0in;} --></style> </head> <body lang=3D"EN-US" link=3D"blue" vlink=3D"purple" style=3D"word-wrap:brea= k-word"> <div class=3D"WordSection1"> <p class=3D"MsoNormal">Ok, I added drive.google.com. <o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <div> <div> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif">-- <o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif">Jerry Benton<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif"><a href=3D"http://www.mailborder.com"><span style=3D"color:#0563C1">= www.mailborder.com</span></a><o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif">+1 843-800-8605<o:p></o:p></span></p> </div> </div> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <div id=3D"mail-editor-reference-message-container"> <div> <div> <div style=3D"border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in = 0in 0in"> <p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><b><span style=3D"col= or:black">From: </span></b><span style=3D"color:black">MailScanner <mailscanner-bounces+= jerry.benton=3Dmailborder.com-qhrM8SXbD5JTOyd/[email protected]> on behalf of Shawn= Iverson via MailScanner <mailscanner-qhrM8SXbD5JTOyd/[email protected]><br> <b>Date: </b>Monday, November 4, 2024 at 12:15<br> <b>To: </b>mailscanner-qhrM8SXbD5JTOyd/[email protected] <[email protected]= nner.info><br> <b>Cc: </b>Shawn Iverson <[email protected]><br> <b>Subject: </b>Re: Phishing Safe Sites</span><span style=3D"font-size:12.0= pt;color:black"><o:p></o:p></span></p> </div> <div> <p class=3D"MsoNormal">drive.google.com seems to be a complaint I sometimes= receive on the MailScanner project because it often shows up in Phishtank,= and it only takes one bad URL reported to Phishtank to cause the entire dr= ive.google.com to get flagged as a bad site.<o:p></o:p></p> </div> <div> <p class=3D"MsoNormal"><o:p> </o:p></p> </div> <div> <p class=3D"MsoNormal">On 11/4/24 11:52, Jerry Benton wrote:<o:p></o:p></p> </div> <blockquote style=3D"margin-top:5.0pt;margin-bottom:5.0pt"> <div> <p class=3D"MsoNormal">I was reviewing the build script for the safe and ba= d sites today. <o:p></o:p></p> <p class=3D"MsoNormal"> <o:p></o:p></p> <ul style=3D"margin-top:0in" type=3D"disc"> <li class=3D"MsoListParagraph" style=3D"margin-left:0in;mso-list:l0 level1 = lfo1">The safe sites file will contain the top 1500 domains on the internet= . This will pretty much be static as AWS no longer publishes that informati= on. It will be updated in the next 4 hours. (Currently empty.)<o:p></o:p></li><li class=3D"MsoListParagraph" st= yle=3D"margin-left:0in;mso-list:l0 level1 lfo1">The bad sites file is still= updated every 4 hours from phishtank with the latest nefarious sites. <o:p></o:p></li><li class=3D"MsoListParagraph" style=3D"margin-left:0in;mso= -list:l0 level1 lfo1">The safe domains used while building the script are b= elow. If you have any suggestions to add to that list, let me know. No, I w= ill not add your personal domain. You can use the custom safe sites list in MailScanner for that. <o:p></o:p></li></ul> <p class=3D"MsoNormal"> <o:p></o:p></p> <p class=3D"MsoNormal"># common short url providers<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'adf.ly';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'bit.ly';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'doiop.com';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'fur.ly';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'goo.gl';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'is.gd';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'mcaf.ee';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'ow.ly';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'snipurl.com';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'su.pr';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'tinyurl.com';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'v.gd';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'tiny.cc';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'tr.im';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'bit.do';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'po.st';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'lrd.to';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'g.co';<o:p></o:p></p> <p class=3D"MsoNormal"> <o:p></o:p></p> <p class=3D"MsoNormal"># known safe domains<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D '<a href=3D"http://www.google.co= m">www.google.com</a>';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'docs.google.com';<o:p></o:p></p= > <p class=3D"MsoNormal">$safe_domains[] =3D 'accounts.google.com';<o:p></o:p= ></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'sites.google.com';<o:p></o:p></= p> <p class=3D"MsoNormal">$safe_domains[] =3D 'mail.google.com';<o:p></o:p></p= > <p class=3D"MsoNormal">$safe_domains[] =3D 'schema.org';<o:p></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'urldefense.proofpoint.com';<o:p= ></o:p></p> <p class=3D"MsoNormal"> <o:p></o:p></p> <div> <div> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif"> </span><o:p></o:p></p> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif">-- </span><o:p></o:p></p> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif">Jerry Benton</span><o:p></o:p></p> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif"><a href=3D"http://www.mailborder.com"><span style=3D"color:#0563C1">= www.mailborder.com</span></a></span><o:p></o:p></p> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif">+1 843-800-8605</span><o:p></o:p></p> </div> </div> <p class=3D"MsoNormal"> <o:p></o:p></p> </div> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt"><br> <br> <o:p></o:p></span></p> <pre><o:p> </o:p></pre> <pre><o:p> </o:p></pre> </blockquote> </div> </div> </div> </div> </body> </html> --_000_DS7PR12MB8372223AEDD89870A58652EAF4512DS7PR12MB8372namp_-- --===============8999234145098146407== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- MailScanner mailing list mailscanner-qhrM8SXbD5JTOyd/[email protected] http://lists.mailscanner.info/mailman/listinfo/mailscanner --===============8999234145098146407==--