Security

last person joined: 23 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Email Receipts flagged as phishing mail in Outlook

This thread has been viewed 0 times

  • 1.  Email Receipts flagged as phishing mail in Outlook

    Posted Jan 19, 2012 03:45 PM

    I have Amigopod set up to use my own SMTP server for guest receipts. However the email receipts that the sponsor receive are flagged as phishing attempts by Outlook 2010. This locks the links that lets the sponsor approve the guest, and the email loses the skin format. Is there any way to fix this?

     

    Thanks.



  • 2.  RE: Email Receipts flagged as phishing mail in Outlook

    Posted Jan 19, 2012 07:53 PM

    We have seen this ourselves recently in but it is not clear what Outlook is using to determine that the email contains phishing content. We obviously need to embed a link to activate the account as part of the sponsor approval process and we will need to investigate with MS to see if there are alternatives in terms of encoding the link to avoid this issue.

     



  • 3.  RE: Email Receipts flagged as phishing mail in Outlook
    Best Answer

    EMPLOYEE
    Posted Jan 20, 2012 09:39 AM

    It can be very tricky getting around phishing and SPAM detection.  Sometimes it is simply the content, sometimes it is receiving the same message over and over.  http://www.gn.apc.org/support/outgoing-mail-wrongly-classed-spam-or-phishing-microsoft-software gives a few reasons that are Outlook specific.

     

    One thing easily to check is what the link is for the registration.  Is it an IP or hsotname?  An IP address would be more suspect than a hostname, and http more than https.  So a perfect link would be https://amigopod.yourdomain.com or whatever, with a valid SSL certificate.  

     



  • 4.  RE: Email Receipts flagged as phishing mail in Outlook

    Posted Jan 24, 2012 10:11 AM
    @gbenedict wrote:

    One thing easily to check is what the link is for the registration.  Is it an IP or hsotname?  An IP address would be more suspect than a hostname, and http more than https.  So a perfect link would be https://amigopod.yourdomain.com or whatever, with a valid SSL certificate.  

     


    This was the issue. The sponsor link was using the IP instead of hostname. If the guest registers through the welcome page using the IP address, the sponsor email will include that IP and be flagged as phishing. So I changed the captive portal in Aruba to use the hostname of amigopod - no more phishing warning.

     

    Thanks!