FP in Phishing Detection

[Nigel Kendrick]

Yes, yes, I know it's html in an email, but it's like Canute and the tide
trying to convince people that although it's pretty it's also a
pain...anyway...

Here's a block from an email sent by our Marketing lady - notice that
'www.petdoctors.co.uk' claims to be 'www.petdoctors.co.uk' - what's tripping
the phishing alert and is it fixable?

(Look away now if easily offended)

<h1><b><font size=2 color=black face=Tahoma><span lang=EN-US
style='font-size:
10.0pt;font-family:Tahoma'>Find out more about Pet Doctors at <a
href="http://www.petdoctors.co.uk/"><font color="red"><b>MailScanner has
detected a possible fraud attempt from "www.petdoctors.co.uk" claiming to
be</b></font> <font face=Arial><span style='font-family:
Arial;mso-bidi-font-family:Tahoma'>www.petdoctors.co.uk</span></font></a></s
pan></font></b><font
size=3 face=Tahoma><span lang=EN-US
style='font-size:12.0pt;mso-bidi-font-size:
10.0pt;font-family:Tahoma'><o:p></o:p></span></font></h1>

Thanks

Nigel Kendrick