Re[2]: Phishing Safe Sites
Tracy Greggs via MailScanner <mailscanner-qhrM8SXbD5JTOyd/[email protected]> Mon, 04 Nov 2024 18:08:59 +0000
| Newsgroups | gmane.mail.virus.mailscanner |
|---|---|
| Message-ID | <[email protected]> |
--===============5818811075636902191== Content-Type: multipart/alternative; boundary="------=_MB135200B3-C2BD-46A4-9B3B-62A286ECD28B" --------=_MB135200B3-C2BD-46A4-9B3B-62A286ECD28B Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable drive.google.com is a constant source of phishing in my observations. =20 Everyone can easily customize to suit their environment though. ------ Original Message ------ From "Jerry Benton" <jerry.benton-OT/[email protected]> To "MailScanner Discussion" <mailscanner-qhrM8SXbD5JTOyd/[email protected]> Date 11/4/2024 12:04:33 PM Subject Re: Phishing Safe Sites >Ok, I added drive.google.com. > > > > > >-- > >Jerry Benton > >www.mailborder.com > >+1 843-800-8605 > > > > > >From: MailScanner=20 ><mailscanner-bounces+jerry.benton=3Dmailborder.com-qhrM8SXbD5JTOyd/[email protected]>= =20 >on behalf of Shawn Iverson via MailScanner=20 ><mailscanner-qhrM8SXbD5JTOyd/[email protected]> >Date: Monday, November 4, 2024 at 12:15 >To: mailscanner-qhrM8SXbD5JTOyd/[email protected]=20 ><mailscanner-qhrM8SXbD5JTOyd/[email protected]> >Cc: Shawn Iverson <[email protected]> >Subject: Re: Phishing Safe Sites > >drive.google.com seems to be a complaint I sometimes receive on the=20 >MailScanner project because it often shows up in Phishtank, and it only=20 >takes one bad URL reported to Phishtank to cause the entire=20 >drive.google.com to get flagged as a bad site. > > > >On 11/4/24 11:52, Jerry Benton wrote: > >>I was reviewing the build script for the safe and bad sites today. >> >> >> >>The safe sites file will contain the top 1500 domains on the internet.=20 >>This will pretty much be static as AWS no longer publishes that=20 >>information. It will be updated in the next 4 hours. (Currently=20 >>empty.) >>The bad sites file is still updated every 4 hours from phishtank with=20 >>the latest nefarious sites. >>The safe domains used while building the script are below. If you have=20 >>any suggestions to add to that list, let me know. No, I will not add=20 >>your personal domain. You can use the custom safe sites list in=20 >>MailScanner for that. >> >> >># common short url providers >> >>$safe_domains[] =3D 'adf.ly'; >> >>$safe_domains[] =3D 'bit.ly'; >> >>$safe_domains[] =3D 'doiop.com'; >> >>$safe_domains[] =3D 'fur.ly'; >> >>$safe_domains[] =3D 'goo.gl'; >> >>$safe_domains[] =3D 'is.gd'; >> >>$safe_domains[] =3D 'mcaf.ee'; >> >>$safe_domains[] =3D 'ow.ly'; >> >>$safe_domains[] =3D 'snipurl.com'; >> >>$safe_domains[] =3D 'su.pr'; >> >>$safe_domains[] =3D 'tinyurl.com'; >> >>$safe_domains[] =3D 'v.gd'; >> >>$safe_domains[] =3D 'tiny.cc'; >> >>$safe_domains[] =3D 'tr.im'; >> >>$safe_domains[] =3D 'bit.do'; >> >>$safe_domains[] =3D 'po.st'; >> >>$safe_domains[] =3D 'lrd.to'; >> >>$safe_domains[] =3D 'g.co'; >> >> >> >># known safe domains >> >>$safe_domains[] =3D 'www.google.com'; >> >>$safe_domains[] =3D 'docs.google.com'; >> >>$safe_domains[] =3D 'accounts.google.com'; >> >>$safe_domains[] =3D 'sites.google.com'; >> >>$safe_domains[] =3D 'mail.google.com'; >> >>$safe_domains[] =3D 'schema.org'; >> >>$safe_domains[] =3D 'urldefense.proofpoint.com'; >> >> >> >> >> >>-- >> >>Jerry Benton >> >>www.mailborder.com >> >>+1 843-800-8605 >> >> >> >> >> >> >> >> --------=_MB135200B3-C2BD-46A4-9B3B-62A286ECD28B Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html><head> <style type=3D"text/css"><!--#xccef93f4cd5645d p.MsoNormal {margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;} #xccef93f4cd5645d a:link {color: blue; text-decoration: underline;} #xccef93f4cd5645d pre {margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Courier New";} #xccef93f4cd5645d li.MsoListParagraph {margin: 0in 0in 0in 0.5in; font-size: 11pt; font-family: Aptos, sans-serif= ;} #xccef93f4cd5645d div.WordSection1 {page: WordSection1;} #xccef93f4cd5645d ul {margin-bottom: 0in;} --></style><style id=3D"css_styles" type=3D"text/css"><!--blockquote.cite { = margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px= ; border-left: 1px solid #cccccc } blockquote.cite2 {margin-left: 5px; margin-right: 0px; padding-left: 10px;= padding-right:0px; border-left: 1px solid #cccccc; margin-top: 3px; padding= -top: 0px; } a img { border: 0px; } table { border-collapse: collapse; } li[style=3D'text-align: center;'], li[style=3D'text-align: center; '], li[s= tyle=3D'text-align: right;'], li[style=3D'text-align: right; '] { list-sty= le-position: inside;} body { font-family: 'Segoe UI'; font-size: 12pt; } .quote { margin-left: 1em; margin-right: 1em; border-left: 5px #ebebeb soli= d; padding-left: 0.3em; } a.em-mention[href] { text-decoration: none; color: inherit; border-radius:= 3px; padding-left: 2px; padding-right: 2px; background-color: #e2e2e2; } --></style> </head> <body><div>drive.google.com is a constant source of phishing in my observat= ions.=C2=A0 Everyone can easily customize to suit their environment though.= </div> <div><br /></div> <div x-em-replyforwardheader=3D""><br /></div> <div> <div>------ Original Message ------</div> <div>From "Jerry Benton" <<a href=3D"mailto:jerry.benton-OT/[email protected]"= >jerry.benton-OT/[email protected]</a>></div> <div>To "MailScanner Discussion" <<a href=3D"mailto:[email protected]= ilscanner.info">mailscanner-qhrM8SXbD5JTOyd/[email protected]</a>></div> <div>Date 11/4/2024 12:04:33 PM</div> <div>Subject Re: Phishing Safe Sites</div></div><div x-em-quote=3D""><br />= </div> <div id=3D"xccef93f4cd5645d" style=3D"word-wrap:break-word"><blockquote cit= e=3D"DS7PR12MB8372223AEDD89870A58652EAF4512-2rwrlj3xeO1DPS5gJ4XbBQdYzm3356Fp3cqxbSTvxBk@public.gmane.org= look.com" type=3D"cite" class=3D"cite2"> <div class=3D"WordSection1"> <p class=3D"MsoNormal">Ok, I added drive.google.com. <o:p xmlns:o=3D"#unkno= wn"></o:p></p> <p class=3D"MsoNormal"><o:p xmlns:o=3D"#unknown">=C2=A0</o:p></p> <div> <div> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif"><o:p xmlns:o=3D"#unknown">=C2=A0</o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif">--=C2=A0<o:p xmlns:o=3D"#unknown"></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif">Jerry Benton<o:p xmlns:o=3D"#unknown"></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif"><a href=3D"http://www.mailborder.com"><span style=3D"color:#0563C1">= www.mailborder.com</span></a><o:p xmlns:o=3D"#unknown"></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif">+1 843-800-8605<o:p xmlns:o=3D"#unknown"></o:p></span></p> </div> </div> <p class=3D"MsoNormal"><o:p xmlns:o=3D"#unknown">=C2=A0</o:p></p> <p class=3D"MsoNormal"><o:p xmlns:o=3D"#unknown">=C2=A0</o:p></p> <div id=3D"mail-editor-reference-message-container"> <div> <div> <div style=3D"border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in= 0in 0in"> <p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><b>From: </b>MailScanner <mailscanner-bounces+jerry.benton=3Dmailborder.com@lists= .mailscanner.info> on behalf of Shawn Iverson via MailScanner <mailsc= anner-qhrM8SXbD5JTOyd/[email protected]><br /> <b>Date: </b>Monday, November 4, 2024 at 12:15<br /> <b>To: </b>mailscanner-qhrM8SXbD5JTOyd/[email protected] <[email protected]= nner.info><br /> <b>Cc: </b>Shawn Iverson <[email protected]><br /> <b>Subject: </b>Re: Phishing Safe Sites<span style=3D"font-size: 12pt;"><o:= p xmlns:o=3D"#unknown"></o:p></span></p> </div> <div> <p class=3D"MsoNormal">drive.google.com seems to be a complaint I sometimes = receive on the MailScanner project because it often shows up in Phishtank, = and it only takes one bad URL reported to Phishtank to cause the entire dr= ive.google.com to get flagged as a bad site. <o:p xmlns:o=3D"#unknown"></o:p></p> </div> <div> <p class=3D"MsoNormal"><o:p xmlns:o=3D"#unknown">=C2=A0</o:p></p> </div> <div> <p class=3D"MsoNormal">On 11/4/24 11:52, Jerry Benton wrote:<o:p xmlns:o=3D= "#unknown"></o:p></p> </div> <blockquote style=3D"margin-top:5.0pt;margin-bottom:5.0pt"> <div> <p class=3D"MsoNormal">I was reviewing the build script for the safe and ba= d sites today. <o:p xmlns:o=3D"#unknown"></o:p></p> <p class=3D"MsoNormal">=C2=A0<o:p xmlns:o=3D"#unknown"></o:p></p> <ul style=3D"margin-top:0in" type=3D"disc"> <li class=3D"MsoListParagraph" style=3D"margin-left:0in;mso-list:l0 level1= lfo1">The safe sites file will contain the top 1500 domains on the internet= . This will pretty much be static as AWS no longer publishes that informati= on. It will be updated in the next 4 hours. (Currently empty.) <o:p xmlns:o=3D"#unknown"></o:p></li><li class=3D"MsoListParagraph" style= =3D"margin-left:0in;mso-list:l0 level1 lfo1">The bad sites file is still up= dated every 4 hours from phishtank with the latest nefarious sites. <o:p xmlns:o=3D"#unknown"></o:p></li><li class=3D"MsoListParagraph" style= =3D"margin-left:0in;mso-list:l0 level1 lfo1">The safe domains used while bu= ilding the script are below. If you have any suggestions to add to that lis= t, let me know. No, I will not add your personal domain. You can use the cu= stom safe sites list in MailScanner for that.=20 <o:p xmlns:o=3D"#unknown"></o:p></li></ul> <p class=3D"MsoNormal">=C2=A0<o:p xmlns:o=3D"#unknown"></o:p></p> <p class=3D"MsoNormal"># common short url providers<o:p xmlns:o=3D"#unknown= "></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'adf.ly';<o:p xmlns:o=3D"#unknow= n"></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'bit.ly';<o:p xmlns:o=3D"#unknow= n"></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'doiop.com';<o:p xmlns:o=3D"#unk= nown"></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'fur.ly';<o:p xmlns:o=3D"#unknow= n"></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'goo.gl';<o:p xmlns:o=3D"#unknow= n"></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'is.gd';<o:p xmlns:o=3D"#unknown= "></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'mcaf.ee';<o:p xmlns:o=3D"#unkno= wn"></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'ow.ly';<o:p xmlns:o=3D"#unknown= "></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'snipurl.com';<o:p xmlns:o=3D"#u= nknown"></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'su.pr';<o:p xmlns:o=3D"#unknown= "></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'tinyurl.com';<o:p xmlns:o=3D"#u= nknown"></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'v.gd';<o:p xmlns:o=3D"#unknown"= ></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'tiny.cc';<o:p xmlns:o=3D"#unkno= wn"></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'tr.im';<o:p xmlns:o=3D"#unknown= "></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'bit.do';<o:p xmlns:o=3D"#unknow= n"></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'po.st';<o:p xmlns:o=3D"#unknown= "></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'lrd.to';<o:p xmlns:o=3D"#unknow= n"></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'g.co';<o:p xmlns:o=3D"#unknown"= ></o:p></p> <p class=3D"MsoNormal">=C2=A0<o:p xmlns:o=3D"#unknown"></o:p></p> <p class=3D"MsoNormal"># known safe domains<o:p xmlns:o=3D"#unknown"></o:p>= </p> <p class=3D"MsoNormal">$safe_domains[] =3D '<a href=3D"http://www.google.co= m">www.google.com</a>';<o:p xmlns:o=3D"#unknown"></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'docs.google.com';<o:p xmlns:o= =3D"#unknown"></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'accounts.google.com';<o:p xmlns= :o=3D"#unknown"></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'sites.google.com';<o:p xmlns:o= =3D"#unknown"></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'mail.google.com';<o:p xmlns:o= =3D"#unknown"></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'schema.org';<o:p xmlns:o=3D"#un= known"></o:p></p> <p class=3D"MsoNormal">$safe_domains[] =3D 'urldefense.proofpoint.com';<o:p = xmlns:o=3D"#unknown"></o:p></p> <p class=3D"MsoNormal">=C2=A0<o:p xmlns:o=3D"#unknown"></o:p></p> <div> <div> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif">=C2=A0</span><o:p xmlns:o=3D"#unknown"></o:p></p> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif">--=C2=A0</span><o:p xmlns:o=3D"#unknown"></o:p></p> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif">Jerry Benton</span><o:p xmlns:o=3D"#unknown"></o:p></p> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif"><a href=3D"http://www.mailborder.com"><span style=3D"color:#0563C1">= www.mailborder.com</span></a></span><o:p xmlns:o=3D"#unknown"></o:p></p> <p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-= serif">+1 843-800-8605</span><o:p xmlns:o=3D"#unknown"></o:p></p> </div> </div> <p class=3D"MsoNormal">=C2=A0<o:p xmlns:o=3D"#unknown"></o:p></p> </div> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt"><br /> <br /> <o:p xmlns:o=3D"#unknown"></o:p></span></p> <pre><o:p xmlns:o=3D"#unknown">=C2=A0</o:p></pre> <pre><o:p xmlns:o=3D"#unknown">=C2=A0</o:p></pre> </blockquote> </div> </div> </div> </div> </blockquote></div> </body></html> --------=_MB135200B3-C2BD-46A4-9B3B-62A286ECD28B-- --===============5818811075636902191== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- MailScanner mailing list mailscanner-qhrM8SXbD5JTOyd/[email protected] http://lists.mailscanner.info/mailman/listinfo/mailscanner --===============5818811075636902191==--