<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word;line-break:after-white-space">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">It was not in gzip format because the update server was handing you a 301 that was not being handled correctly. This will no longer happen.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">-- <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Jerry Benton<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><a href="http://www.mailborder.com"><span style="color:#0563C1">www.mailborder.com</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">+1 843-800-8605<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div id="mail-editor-reference-message-container">
<div>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="color:black">From:
</span></b><span style="color:black">MailScanner <mailscanner-bounces+jerry.benton=mailborder.com@lists.mailscanner.info> on behalf of Bogdan-Stefan Rotariu <bogdan@rotariu.ro><br>
<b>Date: </b>Wednesday, November 6, 2024 at 09:36<br>
<b>To: </b>MailScanner Discussion <mailscanner@lists.mailscanner.info><br>
<b>Subject: </b>Re: Phishing Script and Server Update & Future Plans<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Thank you for the recent update. I would like to suggest two changes:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><br>
1. Since we have already set the PATH, we can simply use ms-peek without specifying the full path (/usr/sbin/ms-peek).<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">2. Regarding the enforcement of HTTPS, we have encountered issues with bad .gz files. Currently, the only fix is to remove them manually. I propose that the script either overwrites these .gz files or removes them
before downloading new ones to prevent this issue.<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:black"><br>
gzip: /usr/mailscanner/etc/phishing.safe.sites.conf.master.gz: not in gzip format</span><o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="color:black"><br>
I have added a workaround to our script:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">if [ -d $CONFIGDIR ]; then<br>
cd $CONFIGDIR<br>
#delete .gz old gz files if left behind<br>
find "$CONFIGDIR" -name "*.gz" -type f -exec rm -f {} +<br>
<br>
Thanks,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">--<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica;color:black">Bogdan-Stefan Rotariu<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On 6 Nov 2024, at 14:20, Jerry Benton <jerry.benton@mailborder.com> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">I have updated the cron script for phishing bad/safe sites to v0.3.1. It is available here:<a href="https://phishing.mailscanner.info/"><span style="color:#467886">https://phishing.mailscanner.info</span></a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">The phishing update server has been updated to use https, but will not force that connection and will now accept http.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">Several previous automatic bad site scrubs were removed for the google domain and several subdomains. This means you will need to add them to the phishing safe sites custom file to retain links to google domains.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">Uncompressed versions of the bad/safe sites files are no longer available. If you have an old script trying to download those files, it will fail. You will need to use the newer update script or modify any
custom scripts to download the compressed versions and then extract them for use.<span class="apple-converted-space"> </span><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">The phishing bad sites is compiled from Phishtank data. It essentially pulls the domains from the phishing links and puts them into a flat file for use in MailScanner.<o:p></o:p></span></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Future plan:</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I am looking into creating a mechanism to populate a SQLite database with phishing links instead of just domains. I am creating this for use in Mailborder, but will make the
database available for MailScanner. In order to be used in MailScanner someone would have to write the code to use it. (I have enough to do.) Once I create a base structure of what the database would look like, I will send out an update here with a link to
the SQLite database. Not sure how this would impact scanning speed at this time. It would of course depend on how big that database gets.</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">The reason why I am looking into this …</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I contacted Openphish about licensing cost to get their database. They want $10k per server per year for the “light” version. That is just nuts.</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">How you can help …</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I need source data to compile this database. I can get some from Phishtank and a very small amount from Openphish free sources. I haven’t put a whole lot of cycles into this,
but if you have any suggestions, please email me.<span class="apple-converted-space"> </span></span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">-- </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Jerry Benton</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><a href="http://www.mailborder.com/"><span style="color:#0563C1">www.mailborder.com</span></a></span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">+1 843-800-8605</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt"> <o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Helvetica"><br>
<br>
--<span class="apple-converted-space"> </span><br>
MailScanner mailing list<br>
</span><a href="mailto:mailscanner@lists.mailscanner.info"><span style="font-size:9.0pt;font-family:Helvetica;color:#467886">mailscanner@lists.mailscanner.info</span></a><span style="font-size:9.0pt;font-family:Helvetica"><br>
</span><a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner"><span style="font-size:9.0pt;font-family:Helvetica;color:#467886">http://lists.mailscanner.info/mailman/listinfo/mailscanner</span></a><o:p></o:p></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>