internal user email quarantined and reason "high confidence phish"

Question

Have you ever seen email quarantined when both sender and recipient are internal organization user and the quarantine reason is high confidence phish by the default built-in anti spam policy?

really confused why it happened and how to avoid such false positive..

darrenferguson · Answer

MSEKIRO&nbsp;I've seen this a few times lately.&nbsp; I've been marking them as false-positives and this seems to be working-- at least for the ones I've reported.&nbsp;Darren

marpas · Answer

YES, you could mark as false positives and I suggest checking the signature or anything else that may contain a link even an image.

cammurray · Answer

MSEKIRO&nbsp;if you look at the detection technology - you should then be able to tell why the message was caught as phish, see below, the email is Phish / Normal, and the detection technology is SPOOF - so this message was caught as Phish because it failed Spoof checks.

&nbsp;

Forum Discussion

internal user email quarantined and reason "high confidence phish"

Share

Resources