Skip to main content

Introduction - Welcome to CFM

🚀 CFM Feature Summary

CFM is a powerful system for managing threat intelligence, spam filtering, phishing protection, and reputation data — backed by automation and agent-based sync.

🛡️ Security & Threat Intelligence

  • Blocklist & Whitelist Management (IP & domain)

  • Reverse DNS, ASN, GeoIP, and country resolution

  • Keyword-based spam detection

  • Phishing URL detection & logging

🔁 Automation & Scheduling

  • Scheduled feed imports, auto-deletion, and rule generation

  • Commands for IP list generation, rule updates, config sync

  • Cron-style job scheduling with overlap protection

🛰️ Agent Infrastructure (C++-Based)

  • Syncs config and rule files

  • Reports blocks, unblocks, and last seen

  • Triggers service restarts after updates

  • Integrates with unblock portal for auto-removal

  • Sends Slack alerts for offline agents

🧪 Antivirus & RBL Integration

  • Generates ClamAV signatures from phishing URLs and file hashes (MD5/SHA1/SHA256)

  • Maintains SpamAssassin-compatible phishing DB

  • Exports RBL and URIBL zones for RBLDNSD

💻 API & External Access

  • Token-authenticated API for:

    • Checking block status

    • Reporting blocks/unblocks

    • Fetching rules/feeds

    • Submitting config/trigger reports

  • Optional rate limiting and IP filtering

📊 Admin Panel (Filament)

  • Dashboard with real-time widgets and charts

  • Interfaces for:

    • Spam keywords

    • Block/allow lists

    • Feed logs

    • Unblock requests

    • Agent activity

🌐 Web Interface

  • Public-facing Unblock Request Form

  • Feed endpoints (IP, domain, phishing, etc.)

  • Admin redirect and login flow

💡 Bonus Features

  • File-based config sync with integrity hashing

  • Config-targeting for agent groups

  • Slack alerts and activity logs

  • Multi-source feed support (manual, API, auto)

🔑 Key Features

✅ Blocklist & Whitelist Management
Manage IPs and domains across multiple lists, including manual entries, feed imports, and API-reported threats.

✅ Spam & Phishing Protection

  • Keyword-based spam filtering (supports Greek/Greeklish, loose/strict)

  • Maintains a live phishing URL database

  • Generates ClamAV-compatible virus definitions from phishing URLs and file hashes (MD5/SHA1/SHA256)

✅ RBL & URIBL Generator
Creates real-time blocklists and URI lists (RBLDNSD format) for DNS-based blacklisting — used by SpamAssassin, Postfix, etc.

✅ GeoIP Intelligence for Blocklist Entries
Automatically resolves:

  • Reverse DNS (PTR)

  • ASN and ISP

  • Country and region This enables rich filtering, analytics, and decision-making.

✅ Automated Feed Processing
Processes threat feeds on a schedule with logs and rule generation.

✅ Agent Communication & API
Lightweight agents (or servers) can:

  • Report blocked IPs back to CFM

  • Fetch updates and policy

  • Submit files, triggers, logs, etc.

✅ Dashboard with Widgets & Metrics
Summarized view of:

  • Top IPs by country or source

  • Phishing trends

  • Recent feed activity

  • System health and jobs

✅ Unblock Request Portal
Public-facing form for users to request delisting — reviewed via admin panel.

✅ Full Admin UI via Filament
Modern interface for managing:

  • Spam keywords

  • Feeds & logs

  • Phishing database

  • Block/allow lists

  • Scheduled jobs

  • Settings & tokens

✅ Scheduled Jobs & Artisan Tools

  • Generate IP and domain blocklists

  • Run cleanup jobs

  • Sync filesystem configs

  • Rebuild ClamAV signatures

  • Trigger per-feed processing

✅ Agent Infrastructure (C++ Powered)
Includes high-performance C++ agents deployed on remote servers that:

  • 🔄 Sync configuration and rule files from CFM

  • 📤 Report blocked and unblocked IPs

  • 🧼 Remove blocks upon updates or unblocks

  • ♻️ Restart services (e.g., mail, firewall) when needed

  • 🧭 Report "last seen" heartbeat to monitor health

  • 🔔 Trigger Slack alerts if an agent goes offline

  • 🤝 Integrate with the public unblock form to re-allow mistakenly blocked users

✅ Blocklist & Whitelist Management
Manage IPs and domains across multiple lists (manual, API, or feed-driven), enriched with PTR, ASN, country, and GeoIP.

✅ Phishing & Spam Defense

  • Greek-aware spam keyword detection (strict/loose)

  • Maintains a phishing URL database

  • Generates ClamAV virus signatures from URLs and hashes (MD5/SHA1/SHA256)

  • Exports phishing data for SpamAssassin compatibility

✅ RBL & URIBL Generation
Creates and serves real-time DNS blacklists (RBLDNSD format) for both IP and domain-based blocklists.

✅ Scheduled Feed Ingestion & Rule Generation
Automates external feed syncing and keyword/rule building via Laravel Scheduler and Artisan commands.

✅ Admin Dashboard
Modern UI with dashboard widgets, charts, and management panels for:

  • Blocked items

  • Keyword rules

  • Feed logs

  • Unblock requests

  • Agent status

✅ Unblock Request Portal
Frontend form where blocked users can request removal — triggers backend unblock workflows and agent sync.

✅ API Interface
Secure, token-authenticated API to:

  • Check IP/domain status

  • Report blocks/unblocks

  • Pull feed or rule updates

  • Trigger diagnostics or config checks

✅ ClamAV + CSF Integration
Outputs live files for:

  • IP blocklists (csf.deny)

  • ClamAV custom signatures

  • RBLDNSD-based DNS lists

💡 Bonus Features

  • Slack integration for agent down alerts

  • Per-country analytics of blocked IPs

  • Top reporters / sources breakdown

  • File-based config sync and hashing

  • Agent group targeting for rules

🧠 Use Cases

  • Internal spam firewall

  • Self-hosted RBL/URIBL provider

  • CSF / UFW / iptables blocklist hub

  • Aggregator for multiple threat feeds

  • Email security gateway enhancement

  • Coordinated threat response via reporting agents

💡 Built With

  • Laravel + Filament (UI)

  • MySQL (DB)

  • Tailwind (optional UI)

  • GeoLite2 (GeoIP)

  • Artisan + Laravel Scheduler

  • RBLDNSD & SpamAssassin compatibility

  • API-first design

No Comments
Back to top