Phishing Script and Server Update & Future Plans
"Jerry Benton" <jerry.benton-OT/[email protected]> Wed, 6 Nov 2024 12:20:40 +0000
| Newsgroups | gmane.mail.virus.mailscanner |
|---|---|
| Message-ID | <DS7PR12MB83721D4379FEA79640D89FD4F4532@DS7PR12MB8372.namprd12.prod.outlook.com> |
--===============6927531012549831120==
Content-Language: en-US
Content-Type: multipart/alternative;
boundary="_000_DS7PR12MB83721D4379FEA79640D89FD4F4532DS7PR12MB8372namp_"
--_000_DS7PR12MB83721D4379FEA79640D89FD4F4532DS7PR12MB8372namp_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
I have updated the cron script for phishing bad/safe sites to v0.3.1. It is=
available here: https://phishing.mailscanner.info
The phishing update server has been updated to use https, but will not forc=
e that connection and will now accept http.
Several previous automatic bad site scrubs were removed for the google doma=
in and several subdomains. This means you will need to add them to the phis=
hing safe sites custom file to retain links to google domains.
Uncompressed versions of the bad/safe sites files are no longer available. =
If you have an old script trying to download those files, it will fail. You=
will need to use the newer update script or modify any custom scripts to d=
ownload the compressed versions and then extract them for use.
The phishing bad sites is compiled from Phishtank data. It essentially pull=
s the domains from the phishing links and puts them into a flat file for us=
e in MailScanner.
Future plan:
I am looking into creating a mechanism to populate a SQLite database with p=
hishing links instead of just domains. I am creating this for use in Mailbo=
rder, but will make the database available for MailScanner. In order to be =
used in MailScanner someone would have to write the code to use it. (I have=
enough to do.) Once I create a base structure of what the database would l=
ook like, I will send out an update here with a link to the SQLite database=
. Not sure how this would impact scanning speed at this time. It would of c=
ourse depend on how big that database gets.
The reason why I am looking into this =85
I contacted Openphish about licensing cost to get their database. They want=
$10k per server per year for the =93light=94 version. That is just nuts.
How you can help =85
I need source data to compile this database. I can get some from Phishtank =
and a very small amount from Openphish free sources. I haven=92t put a whol=
e lot of cycles into this, but if you have any suggestions, please email me=
.
--
Jerry Benton
www.mailborder.com<http://www.mailborder.com>
+1 843-800-8605
--_000_DS7PR12MB83721D4379FEA79640D89FD4F4532DS7PR12MB8372namp_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" xmlns:w=3D"urn:sc=
hemas-microsoft-com:office:word" xmlns:m=3D"http://schemas.microsoft.com/of=
fice/2004/12/omml" xmlns=3D"http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang=3D"EN-US" link=3D"#467886" vlink=3D"#96607D" style=3D"word-wrap:=
break-word">
<div class=3D"WordSection1">
<p class=3D"MsoNormal">I have updated the cron script for phishing bad/safe=
sites to v0.3.1. It is available here:
<a href=3D"https://phishing.mailscanner.info">https://phishing.mailscanner.=
info</a><o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">The phishing update server has been updated to use h=
ttps, but will not force that connection and will now accept http.
<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">Several previous automatic bad site scrubs were remo=
ved for the google domain and several subdomains. This means you will need =
to add them to the phishing safe sites custom file to retain links to googl=
e domains.
<o:p></o:p></p>
<p class=3D"MsoNormal"> <o:p></o:p></p>
<p class=3D"MsoNormal">Uncompressed versions of the bad/safe sites files ar=
e no longer available. If you have an old script trying to download those f=
iles, it will fail. You will need to use the newer update script or modify =
any custom scripts to download the
compressed versions and then extract them for use. <o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">The phishing bad sites is compiled from Phishtank da=
ta. It essentially pulls the domains from the phishing links and puts them =
into a flat file for use in MailScanner.
<o:p></o:p></p>
<div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif">Future plan:<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif">I am looking into creating a mechanism to populate a SQLite database=
with phishing links instead of just domains. I am creating this for use in=
Mailborder, but will make the database available
for MailScanner. In order to be used in MailScanner someone would have to =
write the code to use it. (I have enough to do.) Once I create a base struc=
ture of what the database would look like, I will send out an update here w=
ith a link to the SQLite database.
Not sure how this would impact scanning speed at this time. It would of co=
urse depend on how big that database gets.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif">The reason why I am looking into this =85
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif">I contacted Openphish about licensing cost to get their database. Th=
ey want $10k per server per year for the =93light=94 version. That is just =
nuts.
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif">How you can help =85
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif">I need source data to compile this database. I can get some from Phi=
shtank and a very small amount from Openphish free sources. I haven=92t put=
a whole lot of cycles into this, but if you have
any suggestions, please email me. <o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif"><o:p> </o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif">-- <o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif">Jerry Benton<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif"><a href=3D"http://www.mailborder.com"><span style=3D"color:#0563C1">=
www.mailborder.com</span></a><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-family:"Calibri",sans-=
serif">+1 843-800-8605<o:p></o:p></span></p>
</div>
</div>
<p class=3D"MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>
--_000_DS7PR12MB83721D4379FEA79640D89FD4F4532DS7PR12MB8372namp_--
--===============6927531012549831120==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--
MailScanner mailing list
mailscanner-qhrM8SXbD5JTOyd/[email protected]
http://lists.mailscanner.info/mailman/listinfo/mailscanner
--===============6927531012549831120==--