Git Product home page Git Product logo

phishing's Introduction

Phishing

Central Repository for Adding or Removing Domains / Links from the Phishing.Database project

Toc

Committing Phishing records

DNS systems can operate on the domain level (everything between the protocol and the first /) while IE Squid-proxy or uBlock Origin can operate on both sides of the slashes and protocol independently.

Add Phishing Domains

File Contents
add-domain This list are matching a records 1 to 1 or this domain only (hosts file style RFC:952 and RFC:953
add-wildcard-domain This domain and all it's subdomains should be added. This means if an entire domain is being used for phishing i.e. phishing.example.com, then add it to the domain list (add-domain). If the phishing threat resides inside a subfolder of the domain i.e. /sub/oath/phishing-script/payload.php then add it to the url list (add-link).

include the domain name only (no http / https) and no path (/something)

Add Phishing Urls / Links

To add either a domain, subdomain or a number of URI's to the project, you should be understanding a bit about how it is working.

File Contents
add-link this URI, and only this URI

Add phishing by IP

File Contents
IP-addr.cidr.in-addr.arpa This is a list for blocking phishing by IP address in CIDR notated in-arpa style (rfc:5737)
IP-addr.cidr.list This is a list for blocking phishing by IP address in CIDR notation style (rfc:5737)
IP-addr.in-addr.arpa This is a list for blocking phishing by IP address in in-arpa style (rfc:5737)
IP-addr.list This is a list for blocking phishing by IP address in (strait forward) style (rfc:5737)

False Positives

To be able to keep the whitelist as precise as possible, the Phishing DB are using 3 types of list.

File Contents
The first list Matching 1 on 1. This means, should we only whitelist IE. subdomain1.example.com but not subdomain2.example.com, then this is the list.
The other list (ALL) is wildcard based. This means every subdomains from example.net and lover level such as subdomain1.example.net & subdomain2.example.net. This list also accepts full regex. Except from ending $ and \\ as this is done by automatically.
The third list (RZD) will probably never be used... Read the full doc here before attempting to making changes to it: https://github.com/Ultimate-Hosts-Blacklist/whitelist/blob/script/README.rst#rzd

For better understanding of these specialities, you are welcome to read the tools Readme.

phishing's People

Contributors

actually-akac avatar allaway avatar anthonyjoh586 avatar benolot avatar davidosipov avatar funilrys avatar g0d33p3rsec avatar kalliome avatar kehpry avatar miladardehali avatar mitchellkrogza avatar mrbrain295 avatar noahavrit avatar patrickrabaja avatar peterdavehello avatar ph00lt0 avatar qsboussadia avatar quartzwarrior avatar sige11 avatar smeinecke avatar spirillen avatar technikamateur avatar thandaanda avatar theycallmecharlie avatar tomvivi avatar tsukuyomiotoko avatar tyw7 avatar wagonza avatar webworkrnet avatar zachinquarantine avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar avatar avatar avatar

Forkers

wagonza zachinquarantine totorh behemoth80 reinstej-sci bgamboe fredlubrano bytealex lagclear khoohaoyit minemy davidosipov nkm0528 marleylua tsukuyomiotoko redcodesdev 0chak thomco haxvzje cyberflik voicemod gdv theycallmecharlie alparslanozturk allaway quartzwarrior gugod apoorvbg aboood313 meowcat285 rayshenomega dvid21 fhajduk tukiab heilyy kastello1 d-hav cjemorton kotenok2000 jmini adochwud phishing-detection imolli chankjha nharnie gyarbij hyuraki kkr007 cameronauswide phishadd10 jonathangarcia15 hegrog mrecocakes aaveshdev peterdavehello oshirohugo nathan9745354 magloft hb-cl nousernameinhere priyadivate1 tecles117 ioannis101 erikalejos gafty virtualwebgit xinux11 jhondms gclass0417 fms2309 vpazssoft ufukart pushkraj19 steltek albrtms gm2202 akarasulu r15ch13 n1dallas syserr0r lelas edgarsendernet javierpignata bot0bai misterqam mjasz dzlandis raphaelritter-2bit devipirts someguyx hafizmujtaba llachkar ryan-bothbrains noahavrit jajube cdav1v4l bogdani30 overrea-ch reachfirst7054 thatlurker

phishing's Issues

False positive still in effect a long time after whitelisting PR merge

Domain/URL/IP(s) you believe NOT to be Phishing

https://current.aletheia-test.idtech.no/authorization

Whitelist type

  • 1 to 1 match
  • ALL subdomains or REGEX
  • RZD all sub- and top level domains matching given record(s)

More Information

  • Website was hacked
  • Phishtank
  • OpenPhish
  • VirusTotal
  • Other (Please fill out the next box)

Related external source

No response

Screenshot

No response

Additional context

Whitelisting PR (#380) was merged three days ago, but virustotal still says Phishing Database reports the site as malicious. Why isn't the whitelisting reflected in virustotal yet?

Virustotal link: https://www.virustotal.com/gui/url/164248c4b08e36070dfdbae6a849b4fc079a7e7501ea2015a1922f913c93d016?nocache=1

tabitha-cambodia.org

This record supports both protocol's therefor added twice to the list

https://tabitha-cambodia.org//app/Model/CpgredesPerts/cgi_b!n/cg%C4%AF_bin/ijj%C5%939p0ol932/871%C3%ACtip9oling/P%C4%ABBalyc0%C5%93uk/80%C3%BCe2101b%C4%8D/Bbbw%C4%99biay/lopsdjjjh%C3%AAb%C3%B8jhxhas%C5%93jhghbvssiu8e90j/P%C3%BFBay/?fbclid=IwAR1F2ugJu5vjikpoyymFv4UfN0tX-mziKJGg2Mo-Up_2Q-dmGcVSJM6X0Kg
http://tabitha-cambodia.org//app/Model/CpgredesPerts/cgi_b!n/cg%C4%AF_bin/ijj%C5%939p0ol932/871%C3%ACtip9oling/P%C4%ABBalyc0%C5%93uk/80%C3%BCe2101b%C4%8D/Bbbw%C4%99biay/lopsdjjjh%C3%AAb%C3%B8jhxhas%C5%93jhghbvssiu8e90j/P%C3%BFBay/?fbclid=IwAR1F2ugJu5vjikpoyymFv4UfN0tX-mziKJGg2Mo-Up_2Q-dmGcVSJM6X0Kg

Test of issue template 2

Domain/URL/IP(s) where you have found the Phishing

https://github.com/mitchellkrogza/phishing

Related external source

https://mypdns.org/my-privacy-dns/matrix/-/issues/3080

Describe the issue

Domains created to target instagram accounts.
It is hosted on a single server and of course the server was created for phishing purposes.
Phishing server IP: 34.125.197.109

https://media-helpcenter.com/quadro-login.php

Screenshot

Click to expand

image

False positives and list(s)

In reply to #213 we might fase an issue with only one falsepositive or exclusion list as there are both wildcard and full-match only cases.

The falsepositive list is used as a wildcard list right?

If I remember that right ⏫ this is calling for a new exclusion lists that takes "this match" only which in general might be a good idea, as there are other freely sub-domain hosting services out there.

Alternative is we start demanding people reads and understand the whitelist-tools commands for ALL | REG | RZD etc and have them applying it into one lists.

I therefor suggestion the project will be using two whitelists to simplify contributions to this project.

False Positive

Domain/URL/IP(s) you believe NOT to be Phishing

https://wcei.com.br/

More Information

  • mitchellkrogza Phishing
  • mitchellkrogza Phishing.Database
  • Website was hacked
  • Listed as Phishing on Phishtank or OpenPhish
  • Listed on VirusTotal
  • Other (Please tell us where in Related external source below)

Related external source

No response

Screenshot

No response

Describe the issue

My site is listed in the Total Phishing Virus by Phishingdatabase. But the site is clean, I'll check manually and scan and there's nothing. I ask that it be reassessed and the block removed

https://wcei.com.br/

https://geminifond.com/gemini-transaction/

Domain/URL/IP(s) where you have found the Phishing

scam

Impersonated domain

scam

Describe the issue

crypto scam

Screenshot

No response

Related external source

No response

Phishing Server IPS

Domain/URL/IP(s) where you have found the Phishing

188.34.139.235
23.99.65.85
20.94.249.183
52.170.83.27
188.34.139.235
51.116.134.73
104.46.14.154
20.52.2.74
20.109.185.93
20.115.152.112

Related external source

No response

Describe the issue

There are several server IP addresses opened for phishing purposes. Can you blacklist them?

Screenshot

Click to expand

download

False positive : abbapps.abbotsleigh.nsw.edu.au

Domain/URL/IP(s) you believes NOT to be Phishing

abbotsleigh.nsw.edu.au
https://abbapps.abbotsleigh.nsw.edu.au
https://abbapps.abbotsleigh.nsw.edu.au/fadcauth/login.html

Whitelist type

  • 1 to 1 match
  • ALL subdomains or REGEX
  • RZD all sub- and top level domains matching given record(s)

More Information

  • mitchellkrogza Phishing
  • mitchellkrogza Phishing.Database
  • Website was hacked
  • Listed as Phishing on Phishtank or OpenPhish
  • Listed on VirusTotal
  • Other (Please tell us where in Related external source below)

Related external source

https://www.virustotal.com/gui/url/b1d29cffaedc133aab3bf428fdce627a0a8f22a64f808ee53fd642a90baab280
https://www.virustotal.com/gui/url/268846513b97eaea5a7c685a88cedb9b419ac51a342389eee830a094bc0037db

Screenshot

No response

Describe the issue

  1. Spirillen closed my pull request 280. and emailed me that "As the you are blocking our tests we are unable to work with this issue. Please open new issue, once you have solved your server issues".
  2. Please let me know what error you get.
  3. Please let me know what IP your testing is coming from.

Test of issue template

Domain/URL/IP(s) where you have found the Phishing

https://example.com
https://example.org/phishing
192.0.2.0/24

Related external source

No response

Describe the issue

Test of issue template

Screenshot

No response

androidauthority.com

Domain/URL/IP(s) you believe NOT to be Phishing

androidauthority.com/

More Information

  • mitchellkrogza Phishing
  • mitchellkrogza Phishing.Database
  • Website was hacked
  • Listed as Phishing on Phishtank or OpenPhish
  • Listed on VirusTotal
  • Other (Please tell us where in Related external source below)

Related external source

No response

Screenshot

No response

Describe the issue

This is a news blog website.

Workflow from Phishing => Phishing.Database => VirusTotal

Copy of #391 (comment) by @g0d33p3rsec

I'll merge them, then pyfunceble will remove the dead once

Thanks! I wonder if pyfunceble may be causing the false negatives when I add as domain or wildcard. When I first added by individual URI, Virus Total would return a positive once the commit was merged upstream. Since, as I've been adding as domain or wildcard, the sites seem to be dropped by the time this repo is merged upstream resulting in subsequent false negatives on VT from the Phishing Database even though the upstream repo showed recent merges. That's why I tried testing both a few commits ago but the results were inconclusive. I should have more time to dig into it after the semester ends next week. If you want to compare output, I've been trying to track the group using a VT collection which can be found at https://www.virustotal.com/gui/collection/5b7e996c553034dddc8c690ea6be0adb3182b0fa96ce6a8b29627e165fb47f38/iocs

Here's an example from a recent add https://www.virustotal.com/gui/url/0503dbd260648c364c10793657cdebe883da30554b3c9cbed639025ea45e58e7 Most of the detections shown are from hand feeding the domain to the individual EDR vendors, which can be a bit laborious.
image
image

southerninsurs.com fraudulent website

Domain/URL/IP(s) where you have found the Phishing

https://southerninsurs.com

Impersonated domain

The legit Southern Insurance company has no official website at that moment. This company works with Visy internal subdivisions and some corporate clients.

Describe the issue

HI,

I am writing to bring a matter of utmost importance to your attention. It has come to our notice that criminals have taken advantage of typo-squatting tactics by deploying the website southerninsurs.com . I must emphasize that the Southern Insurance company, which is based in Singapore and owned by Visy Group (the company I am working for), has absolutely no association with this website.

Due to the severity of this situation, the Singapore police have taken action by blocking access to this website from Singaporean IP addresses. However, there remains a significant risk that potential clients accessing the site from other countries may unknowingly fall victim to these unscrupulous individuals. In fact, one of our valued clients was recently defrauded of $300,000 under the false assumption that they were engaging with a legitimate company.

Could you please mark this site as phishing?

Thank you for your prompt attention to this matter.

Yours sincerely,
Patrick Ocean
Cyber Security Analyst
VISY
53 Charles St,
Coburg North,
Victoria, Australia

M:+61488 111 373 W: www.visy.com.au

Screenshot

No response

Related external source

No response

vodafone.de

Domain/URL/IP(s) you believes NOT to be Phishing

vodafone.de
live.vodafone.de

https://live.vodafone.de
https://www.vodafone.de/cprx/captcha
https://www.vodafone.de/meinvodafone/account/login?protocol=oidc

Whitelist type

  • 1 to 1 match
  • ALL subdomains or REGEX
  • RZD all sub- and top level domains matching given record(s)

More Information

  • mitchellkrogza Phishing
  • mitchellkrogza Phishing.Database
  • Website was hacked
  • Listed as Phishing on Phishtank or OpenPhish
  • Listed on VirusTotal
  • Other (Please tell us where in Related external source below)

Related external source

No response

Screenshot

No response

Describe the issue

Found in ALL-phishing-domains and ALL-phishing-links archives. Not a phishing site and doesn't seem to have been hacked recently. VirusTotal shows no hits (Even for Phishing.Database weirdly enough)

Any idea how these got reported as phishing? I'm guessing these archives are already filtered with your whitelist, correct?

Phishing IP

212.64.215.12

I request you to blacklist the IP address. Again, the domains connected to this IP address are listed. I will PR

Invalid detection

Domain/URL/IP(s) you believe NOT to be Phishing

surveysparrow.com

Whitelist type

  • 1 to 1 match
  • ALL subdomains or REGEX
  • RZD all sub- and top level domains matching given record(s)

More Information

  • Website was hacked
  • Phishtank
  • OpenPhish
  • VirusTotal
  • Other (Please fill out the next box)

Related external source

No response

Screenshot

No response

Additional context

This is a survey platform. However, the global domain is marked as phishing. Not a phishing site.

Any idea how these got reported as phishing?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.