<html><head>
<style type="text/css"><!--#xccef93f4cd5645d p.MsoNormal
{margin: 0in; font-size: 11pt; font-family: Aptos, sans-serif;}
#xccef93f4cd5645d a:link
{color: blue; text-decoration: underline;}
#xccef93f4cd5645d pre
{margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Courier New";}
#xccef93f4cd5645d li.MsoListParagraph
{margin: 0in 0in 0in 0.5in; font-size: 11pt; font-family: Aptos, sans-serif;}
#xccef93f4cd5645d div.WordSection1
{page: WordSection1;}
#xccef93f4cd5645d ul
{margin-bottom: 0in;}
--></style><style id="css_styles" type="text/css"><!--blockquote.cite { margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc }
blockquote.cite2 {margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc; margin-top: 3px; padding-top: 0px; }
a img { border: 0px; }
table { border-collapse: collapse; }
li[style='text-align: center;'], li[style='text-align: center; '], li[style='text-align: right;'], li[style='text-align: right; '] { list-style-position: inside;}
body { font-family: 'Segoe UI'; font-size: 12pt; }
.quote { margin-left: 1em; margin-right: 1em; border-left: 5px #ebebeb solid; padding-left: 0.3em; }
a.em-mention[href] { text-decoration: none; color: inherit; border-radius: 3px; padding-left: 2px; padding-right: 2px; background-color: #e2e2e2; }
--></style>
</head>
<body><div>drive.google.com is a constant source of phishing in my observations. Everyone can easily customize to suit their environment though.</div>
<div><br /></div>
<div x-em-replyforwardheader=""><br /></div>
<div>
<div>------ Original Message ------</div>
<div>From "Jerry Benton" <<a href="mailto:jerry.benton@mailborder.com">jerry.benton@mailborder.com</a>></div>
<div>To "MailScanner Discussion" <<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a>></div>
<div>Date 11/4/2024 12:04:33 PM</div>
<div>Subject Re: Phishing Safe Sites</div></div><div x-em-quote=""><br /></div>
<div id="xccef93f4cd5645d" style="word-wrap:break-word"><blockquote cite="DS7PR12MB8372223AEDD89870A58652EAF4512@DS7PR12MB8372.namprd12.prod.outlook.com" type="cite" class="cite2">
<div class="WordSection1">
<p class="MsoNormal">Ok, I added drive.google.com. <o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal"><o:p xmlns:o="#unknown"> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif"><o:p xmlns:o="#unknown"> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif">-- <o:p xmlns:o="#unknown"></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif">Jerry Benton<o:p xmlns:o="#unknown"></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif"><a href="http://www.mailborder.com"><span style="color:#0563C1">www.mailborder.com</span></a><o:p xmlns:o="#unknown"></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif">+1 843-800-8605<o:p xmlns:o="#unknown"></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p xmlns:o="#unknown"> </o:p></p>
<p class="MsoNormal"><o:p xmlns:o="#unknown"> </o:p></p>
<div id="mail-editor-reference-message-container">
<div>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b>From:
</b>MailScanner <mailscanner-bounces+jerry.benton=mailborder.com@lists.mailscanner.info> on behalf of Shawn Iverson via MailScanner <mailscanner@lists.mailscanner.info><br />
<b>Date: </b>Monday, November 4, 2024 at 12:15<br />
<b>To: </b>mailscanner@lists.mailscanner.info <mailscanner@lists.mailscanner.info><br />
<b>Cc: </b>Shawn Iverson <shawniverson@summitgrid.com><br />
<b>Subject: </b>Re: Phishing Safe Sites<span style="font-size: 12pt;"><o:p xmlns:o="#unknown"></o:p></span></p>
</div>
<div>
<p class="MsoNormal">drive.google.com seems to be a complaint I sometimes receive on the MailScanner project because it often shows up in Phishtank, and it only takes one bad URL reported to Phishtank to cause the entire drive.google.com to get flagged as a
bad site.
<o:p xmlns:o="#unknown"></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p xmlns:o="#unknown"> </o:p></p>
</div>
<div>
<p class="MsoNormal">On 11/4/24 11:52, Jerry Benton wrote:<o:p xmlns:o="#unknown"></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">I was reviewing the build script for the safe and bad sites today.
<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal"> <o:p xmlns:o="#unknown"></o:p></p>
<ul style="margin-top:0in" type="disc">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1">The safe sites file will contain the top 1500 domains on the internet. This will pretty much be static as AWS no longer publishes that information. It will be updated in the next 4
hours. (Currently empty.)
<o:p xmlns:o="#unknown"></o:p></li><li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1">The bad sites file is still updated every 4 hours from phishtank with the latest nefarious sites.
<o:p xmlns:o="#unknown"></o:p></li><li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1">The safe domains used while building the script are below. If you have any suggestions to add to that list, let me know. No, I will not add your personal domain. You can use the custom
safe sites list in MailScanner for that.
<o:p xmlns:o="#unknown"></o:p></li></ul>
<p class="MsoNormal"> <o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal"># common short url providers<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'adf.ly';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'bit.ly';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'doiop.com';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'fur.ly';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'goo.gl';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'is.gd';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'mcaf.ee';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'ow.ly';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'snipurl.com';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'su.pr';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'tinyurl.com';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'v.gd';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'tiny.cc';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'tr.im';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'bit.do';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'po.st';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'lrd.to';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'g.co';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal"> <o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal"># known safe domains<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = '<a href="http://www.google.com">www.google.com</a>';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'docs.google.com';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'accounts.google.com';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'sites.google.com';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'mail.google.com';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'schema.org';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal">$safe_domains[] = 'urldefense.proofpoint.com';<o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal"> <o:p xmlns:o="#unknown"></o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif"> </span><o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif">-- </span><o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif">Jerry Benton</span><o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif"><a href="http://www.mailborder.com"><span style="color:#0563C1">www.mailborder.com</span></a></span><o:p xmlns:o="#unknown"></o:p></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif">+1 843-800-8605</span><o:p xmlns:o="#unknown"></o:p></p>
</div>
</div>
<p class="MsoNormal"> <o:p xmlns:o="#unknown"></o:p></p>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt"><br />
<br />
<o:p xmlns:o="#unknown"></o:p></span></p>
<pre><o:p xmlns:o="#unknown"> </o:p></pre>
<pre><o:p xmlns:o="#unknown"> </o:p></pre>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote></div>
</body></html>