Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

How to stop Thunderbird from classifying my collegue's Airmail messages as scam

  • 4 svar
  • 4 har dette problemet
  • 10 views
  • Siste svar av Nils T

more options

Thunderbird keeps classifying almost all mail from one of my colleagues as scam.

His sending address is in my address book.

I suspect it has to do with how his MUA (Apple Airmail) formats the emails.

I do not want to disable Scam detection in general.

Any ideas?

Using Thunderbird 52.3.0+build1-0ubuntu0.16.04.1 on Ubuntu 16.04.3 LTS

Thunderbird keeps classifying almost all mail from one of my colleagues as scam. His sending address is in my address book. I suspect it has to do with how his MUA (Apple Airmail) formats the emails. I do not want to disable Scam detection in general. Any ideas? Using Thunderbird 52.3.0+build1-0ubuntu0.16.04.1 on Ubuntu 16.04.3 LTS

Valgt løsning

sure. The detection is very basic so all that triggers it is listed here https://support.mozilla.org/en-US/kb/thunderbirds-scam-detection#w_thunderbirds-automatic-scam-filtering

To summarize

  • Links with numerical server names (http://127.0.0.1/).
  • Links where the text doesn't match the server name (for example, the text of the message might say "https://secure.example.com" but the link actually goes to "http://phishing.example.com" instead). Phishers do this to fool you into going to their site. Unfortunately some legitimate mailing lists also do this with redirectors for tracking purposes.
  • A remote image link that has different image source than the link points to (spoofing a legitimate web site, similar to the link spoofing described above).
Les dette svaret i sammenhengen 👍 2

All Replies (4)

more options

You have no choices beyond what you apparently are aware of. Modify the email or disable the scam detection are the choices. There are no hidden tweaks or settings is is really an incomplete feature that has languished for years.

more options

Thank you Matt.

Is there any documentation of how my colleague could change the format of his mails that make it less likely to trigger Thunderbird's scam detection?

more options

Valgt løsning

sure. The detection is very basic so all that triggers it is listed here https://support.mozilla.org/en-US/kb/thunderbirds-scam-detection#w_thunderbirds-automatic-scam-filtering

To summarize

  • Links with numerical server names (http://127.0.0.1/).
  • Links where the text doesn't match the server name (for example, the text of the message might say "https://secure.example.com" but the link actually goes to "http://phishing.example.com" instead). Phishers do this to fool you into going to their site. Unfortunately some legitimate mailing lists also do this with redirectors for tracking purposes.
  • A remote image link that has different image source than the link points to (spoofing a legitimate web site, similar to the link spoofing described above).
more options

Thank you Matt. Your hint helped me find the broken link "where the text doesn't match the server name" in the sender's HTML signature. Mystery solved, i notified my colleague!

Endret av Nils T