Phishing warning about my own signature?

[ovizii]

/etc/MailScanner/reports/en/inline.sig.in.html looks like this:

Code: Select all

<br />--
<br />This message has been scanned for viruses and dangerous content by <br />
our in-house <b>Email Filtering Appliance</b>, and is believed to be clean.<br />
Click <a href="http://192.168.220.2/cgi-bin/learn-msg.cgi?id=$id&token=$token">here</a> to report this message as SPAM.

Incoming mails have a phishing warning appended to this link. No idea why this happens. Anyone ever had his own signature marked as phishing attempt?

[shawniverson]

Yeah, if Detect Phishing Fraud is enabled, this may happen.

[ovizii]

The option "numeric phishing = yes" was responsible for this so I tried changing that to a ruleset but am unsure what format this ruleset would be, do I insert my IP <space> NO?

[shawniverson]

Use tabs instead of spaces. i.e.

From:<tab>IP<tab>no

[shawniverson]

https://github.com/E-F-A/v3/issues/345

[ovizii]

Still a no-go:

Code: Select all

Syntax error in first field in line 1 of ruleset /etc/MailScanner/find.numeric.phishing.rules at /usr/share/MailScanner/perl/MailScanner/Config.pm line 2706

Code: Select all

Also Find Numeric Phishing =  %etc-dir%/find.numeric.phishing.rules

cat find.numeric.phishing.rules

Code: Select all

192.168.220.2 no

[shawniverson]

The rule is missing the "From:" prefix?