Phishing Safe Sites

[Tracy Greggs]

drive.google.com is a constant source of phishing in my observations.  
Everyone can easily customize to suit their environment though.


------ Original Message ------
>From "Jerry Benton" <jerry.benton at mailborder.com>
To "MailScanner Discussion" <mailscanner at lists.mailscanner.info>
Date 11/4/2024 12:04:33 PM
Subject Re: Phishing Safe Sites

>Ok, I added drive.google.com.
>
>
>
>
>
>--
>
>Jerry Benton
>
>www.mailborder.com
>
>+1 843-800-8605
>
>
>
>
>
>From: MailScanner 
><mailscanner-bounces+jerry.benton=mailborder.com at lists.mailscanner.info> 
>on behalf of Shawn Iverson via MailScanner 
><mailscanner at lists.mailscanner.info>
>Date: Monday, November 4, 2024 at 12:15
>To: mailscanner at lists.mailscanner.info 
><mailscanner at lists.mailscanner.info>
>Cc: Shawn Iverson <shawniverson at summitgrid.com>
>Subject: Re: Phishing Safe Sites
>
>drive.google.com seems to be a complaint I sometimes receive on the 
>MailScanner project because it often shows up in Phishtank, and it only 
>takes one bad URL reported to Phishtank to cause the entire 
>drive.google.com to get flagged as a bad site.
>
>
>
>On 11/4/24 11:52, Jerry Benton wrote:
>
>>I was reviewing the build script for the safe and bad sites today.
>>
>>
>>
>>The safe sites file will contain the top 1500 domains on the internet. 
>>This will pretty much be static as AWS no longer publishes that 
>>information. It will be updated in the next 4 hours. (Currently 
>>empty.)
>>The bad sites file is still updated every 4 hours from phishtank with 
>>the latest nefarious sites.
>>The safe domains used while building the script are below. If you have 
>>any suggestions to add to that list, let me know. No, I will not add 
>>your personal domain. You can use the custom safe sites list in 
>>MailScanner for that.
>>
>>
>># common short url providers
>>
>>$safe_domains[] = 'adf.ly';
>>
>>$safe_domains[] = 'bit.ly';
>>
>>$safe_domains[] = 'doiop.com';
>>
>>$safe_domains[] = 'fur.ly';
>>
>>$safe_domains[] = 'goo.gl';
>>
>>$safe_domains[] = 'is.gd';
>>
>>$safe_domains[] = 'mcaf.ee';
>>
>>$safe_domains[] = 'ow.ly';
>>
>>$safe_domains[] = 'snipurl.com';
>>
>>$safe_domains[] = 'su.pr';
>>
>>$safe_domains[] = 'tinyurl.com';
>>
>>$safe_domains[] = 'v.gd';
>>
>>$safe_domains[] = 'tiny.cc';
>>
>>$safe_domains[] = 'tr.im';
>>
>>$safe_domains[] = 'bit.do';
>>
>>$safe_domains[] = 'po.st';
>>
>>$safe_domains[] = 'lrd.to';
>>
>>$safe_domains[] = 'g.co';
>>
>>
>>
>># known safe domains
>>
>>$safe_domains[] = 'www.google.com';
>>
>>$safe_domains[] = 'docs.google.com';
>>
>>$safe_domains[] = 'accounts.google.com';
>>
>>$safe_domains[] = 'sites.google.com';
>>
>>$safe_domains[] = 'mail.google.com';
>>
>>$safe_domains[] = 'schema.org';
>>
>>$safe_domains[] = 'urldefense.proofpoint.com';
>>
>>
>>
>>
>>
>>--
>>
>>Jerry Benton
>>
>>www.mailborder.com
>>
>>+1 843-800-8605
>>
>>
>>
>>
>>
>>
>>
>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20241104/f2b7da97/attachment-0001.html>