Where did you install Firefox from? Help Mozilla uncover 3rd party websites that offer problematic Firefox installation by taking part in our campaign. There will be swag, and you'll be featured in our blog if you manage to report at least 10 valid reports!

Avatar for Username

Etsi tuesta

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Ketju on arkistoitu. Esitä kysymys, jos tarvitset apua.

How to stop Thunderbird from classifying my collegue's Airmail messages as scam

  • 4 vastausta
  • 4 henkilöllä on sama ongelma
  • 10 näyttöä
  • Viimeisin kirjoittaja Nils T

Nils T
Nils T
more options

Thunderbird keeps classifying almost all mail from one of my colleagues as scam.

His sending address is in my address book.

I suspect it has to do with how his MUA (Apple Airmail) formats the emails.

I do not want to disable Scam detection in general.

Any ideas?

Using Thunderbird 52.3.0+build1-0ubuntu0.16.04.1 on Ubuntu 16.04.3 LTS

Thunderbird keeps classifying almost all mail from one of my colleagues as scam. His sending address is in my address book. I suspect it has to do with how his MUA (Apple Airmail) formats the emails. I do not want to disable Scam detection in general. Any ideas? Using Thunderbird 52.3.0+build1-0ubuntu0.16.04.1 on Ubuntu 16.04.3 LTS

Valittu ratkaisu

sure. The detection is very basic so all that triggers it is listed here https://support.mozilla.org/en-US/kb/thunderbirds-scam-detection#w_thunderbirds-automatic-scam-filtering

To summarize

  • Links with numerical server names (http://127.0.0.1/).
  • Links where the text doesn't match the server name (for example, the text of the message might say "https://secure.example.com" but the link actually goes to "http://phishing.example.com" instead). Phishers do this to fool you into going to their site. Unfortunately some legitimate mailing lists also do this with redirectors for tracking purposes.
  • A remote image link that has different image source than the link points to (spoofing a legitimate web site, similar to the link spoofing described above).
Lue tämä vastaus kontekstissaan 👍 2

Kaikki vastaukset (4)

Matt
Matt
  • Moderator
  • Top 10 Contributor
more options

You have no choices beyond what you apparently are aware of. Modify the email or disable the scam detection are the choices. There are no hidden tweaks or settings is is really an incomplete feature that has languished for years.

Nils T
Nils T Kysymyksen kysyjä
more options

Thank you Matt.

Is there any documentation of how my colleague could change the format of his mails that make it less likely to trigger Thunderbird's scam detection?

Matt
Matt
  • Moderator
  • Top 10 Contributor
more options

Valittu ratkaisu

sure. The detection is very basic so all that triggers it is listed here https://support.mozilla.org/en-US/kb/thunderbirds-scam-detection#w_thunderbirds-automatic-scam-filtering

To summarize

  • Links with numerical server names (http://127.0.0.1/).
  • Links where the text doesn't match the server name (for example, the text of the message might say "https://secure.example.com" but the link actually goes to "http://phishing.example.com" instead). Phishers do this to fool you into going to their site. Unfortunately some legitimate mailing lists also do this with redirectors for tracking purposes.
  • A remote image link that has different image source than the link points to (spoofing a legitimate web site, similar to the link spoofing described above).
Nils T
Nils T Kysymyksen kysyjä
more options

Thank you Matt. Your hint helped me find the broken link "where the text doesn't match the server name" in the sender's HTML signature. Mystery solved, i notified my colleague!

Muokattu , muokkaaja Nils T