[clamav-users] FP with Heuristics.Phishing.Email.SpoofedDomain

[Paul]

Hi

I have 2 emails which have tripped 
Heuristics.Phishing.Email.SpoofedDomain (4 times in each email using 
clamscan -x option)

Is the output from clamscan -x --debug shown below indicate the 
offending url pair triggering Heuristics.Phishing.Email.SpoofedDomain?

LibClamAV debug: Phishing: looking up in whitelist: 
.clicktime.symantec.com:.www
.barclays.co.uk; host-only:1
LibClamAV debug: Phishing: looking up in whitelist: 
.clicktime.symantec.com:.www
.barclays.co.uk; host-only:1
LibClamAV debug: Phishing: looking up in whitelist: 
.clicktime.symantec.com:.www
.barclays.co.uk; host-only:1
LibClamAV debug: Phishing: looking up in whitelist: 
.clicktime.symantec.com:.www
.barclays.co.uk; host-only:1