Re: [clamav-users] Amazon/SpoofedDomain FP

2022-03-17 Thread Alex via clamav-users
Hi, > Micah has given you plenty to go on. I'd add that you can search the > docs online, for example: > > https://docs.clamav.net/?search=false%20positive > > To prevent all such detections, see 'PhishingScanURLs' in the man page > for clamd.conf. Thank you both for your help. The following pat

Re: [clamav-users] Amazon/SpoofedDomain FP

2022-03-17 Thread G.W. Haywood via clamav-users
Hi there, On Thu, 17 Mar 2022, Alex via clamav-users wrote: The link description is a URL and apparently doesn't match the link itself, resulting in email from Amazon Business being marked as malicious. Do I just add this to some kind of allow/bypass list? How do I go about doing that? Micah

Re: [clamav-users] Amazon/SpoofedDomain FP

2022-03-17 Thread Micah Snyder (micasnyd) via clamav-users
m: clamav-users on behalf of Maarten Broekman via clamav-users Sent: Thursday, March 17, 2022 10:26 AM To: ClamAV users ML Cc: Maarten Broekman Subject: Re: [clamav-users] Amazon/SpoofedDomain FP That's indicating that there is a link in the email that's displaying "www.america

Re: [clamav-users] Amazon/SpoofedDomain FP

2022-03-17 Thread Maarten Broekman via clamav-users
That's indicating that there is a link in the email that's displaying " www.americanexpress.com" but is actually going to "www.amazonbusiness.com". It's hard to help without seeing the original email code. On Thu, Mar 17, 2022 at 12:55 PM Alex via clamav-users < clamav-users@lists.clamav.net> wrot