search

MailScanner / v5

MailScanner v5
GNU General Public License v2.0
183 stars 58 forks source link

definite fraud in the website at "sites.google.com" #300

Closed aloboa closed 5 years ago

aloboa commented 5 years ago

I've been notified that MailScanner reports: "MailScanner has detected definite fraud in the website at "sites.google.com"" and then advices not to trust my web page https://sites.google.com/site/aloboaleu/ Why? I do not have anything intentionally harmful, how can I know the exact reason so that I can remove what is seen as a thread? Thanks

shawniverson commented 5 years ago

@aloboa You can add sites.google.com to /etc/MailScanner/phishing.safe.sites.custom to permanently whitelist and then run /usr/sbin/ms-update-phishing as root.

aloboa commented 5 years ago

But this would solve the problem on my computer only, right? The point is that I do not want my site being reported as a thread by MailScanner on other people's computer, not just on mine. I want to know the reason why MailScanner is reporting fraud in my website. In fact, I think I do have the right of knowing why my site is being reported by fraud.

shawniverson commented 5 years ago

@aloboa http://phishing.mailscanner.info/

aloboa commented 5 years ago

I even do not have Mailscanner installed, but I've checked for my site in http://www.phishtank.com/, which is used by Mailscanner according to http://phishing.mailscanner.info/. There I get: "Nothing known about https://sites.google.com/site/aloboaleu/" So why is my site being reported by Mailscanner?

shawniverson commented 5 years ago

www.sites.google.com is on phishtank

aloboa commented 5 years ago

phistank reports 1 site in www.sites.google.com, not my site. Why is Mailscanner advising not to trust my site? I think the notification is an abuse. Are the scripts in http://phishing.mailscanner.info/ going to solve this problem for my computer only or for all computers using Mailscanner?

shawniverson commented 5 years ago

@jcbenton Should there be a whitelist exception for sites.google.com? MailScanner is flagging www.sites.google.com as a phish, but depending on the phishing configuration of MailScanner, sites.google.com is also getting flagged.

jcbenton commented 5 years ago

He can add it to his phishing whitelist, right?

aloboa commented 5 years ago

@jcbenton The problem is that my site is being declared as not to be trusted to any user of mailscanner while the fact is that phistank declares "Nothing known about https://sites.google.com/site/aloboaleu/" I cannot go and change the configuration of every mailscanner user to "whiten it", can I? It is your responsibility providing reliable advice. Currently, the email server of an university stamps that mailscanner message against my web site just after my signature when they get messages from me, I've been called on the phone by colleagues. I think this is a shame and totally illegal.

shawniverson commented 5 years ago

@aloboa There is nothing illegal about this, I know of no law or statute that says otherwise. Personally, I wouldn't trust sites.google.com anyway, since anyone can upload pretty much anything they want. I wouldn't be opposed to @jcbenton denying your request, and I certainly don't think this type of finger pointing is conducive to a constructive discussion. Any person running MailScanner can, at their own option, whitelist you and/or alter their config to be stricter on the phishing algorithm and exclude parent domains.

jcbenton commented 5 years ago

Let's get something straight bud. Your IT infrastructure and website platform choice is not my responsibility. A lot of attack vectors come from sites.google.com, so it is going to get listed at phishtank and it is going to get incorporated into the blacklist. We provide the product. We don't manage everyone's infrastructure. Your complaint is akin to bitching at Airbus because you don't like how a pilot flies a plane they made. If you have a problem with a university blocking links to your website in email, then you need to talk to the IT people at that university.

aloboa commented 5 years ago

I am not your bud. This is certainly not a constructive discussion, even degrades to unpolite, so I will not continue with it. My complaint is akin to notifying at an aircraft maker because an accident was due to a defective part.

jcbenton commented 5 years ago

It stopped being constructive when you poked your finger in my chest outlining my responsibilities thinking your area of expertise somehow makes you an expert in mine, which was exceptionally impolite.

msapiro commented 5 years ago

@aloboa I've been reading this thread and almost replied yesterday. The issue is this. Phishtank doesn't list URLs; it lists domains. It lists the domain sites.google.com because of reports about some 'site' within that domain which is not your site, but is in the same sites.google.com domain as your site.

Unfortunately, when providers like google make services available to multiple users via a single domain, the bad acts of one user affect the reputation of the domain and affect all other users of that domain. The only way to avoid that is to avoid using 'community' domains.

The bottom line here however is your complaint is with Phishtank, not MailScanner.