[clamav-users] Heuristics.Phishing.Email.SpoofedDomain...

[eric-list at truenet.com]

Just a heads up.  I noticed a bunch of American Express Statements in our
quarantine.
My guess is because they are using m.amex and go.amex links in the emails.

DKIM and SPF pass so these definitely seem to be legit AMEX emails.
>From address is "American Express" <AmericanExpress at welcome.aexp.com>

Sincerely,

Eric Tykwinski
TrueNet, Inc.
P: 610-429-8300