diff --git a/config/action.d/xarf-login-attack.conf b/config/action.d/xarf-login-attack.conf
index d7bae58a..c45a9464 100644
--- a/config/action.d/xarf-login-attack.conf
+++ b/config/action.d/xarf-login-attack.conf
@@ -42,7 +42,7 @@ actionban = ADDRESSES=`querycontacts <ip>`
                 (printf -- %%b "<header>\n<message>\n<report>\n${MATCHES}\n";
                  date '+Note: Local timezone is %%z (%%Z)';
                  tail -n <loglines> <logpath> | grep '[^0-9]<ip>[^0-9]';
-                 printf -- %%b "<footer>") | tee /tmp/message | <mailcmd> "abuse report about <ip> - $DATE" <mailargs> $ADDRESSES
+                 printf -- %%b "<footer>") | <mailcmd> "abuse report about <ip> - $DATE" <mailargs> $ADDRESSES
             fi
 
 actionunban =