Re: false positive from a third party defination

On 12 December 2024 23:46:26 Lyle Giese via clamav-users 
<[email protected]> wrote:

> Not sure where I need to report this.  I am having legit email being
> bounced using ClamAV by this:
>
> Heuristics.Phishing.Email.SpoofedDomain(cd2d755959754996812d9dc9405de4be:121605)

Hi.

It's not a 3rd party definition.

It is a configuration option within ClamAV.

You need to add the following to the Clam conf file:

PhishingScanURLs no

And  submit your email as an fp to ClamAV.



>
>
> This email is legit from Hilton Honors.
>
> Thanks,
>
> Lyle Giese
>
>
> _______________________________________________
>
> Manage your clamav-users mailing list subscription / unsubscribe:
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/Cisco-Talos/clamav-documentation
>
> https://docs.clamav.net/#mailing-lists-and-chat


Cheers,

Steve
Sanesecurity

_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat