This site will have limited functionality while we undergo maintenance to improve your experience. If an article doesn't solve your issue and you want to ask a question, we have our support community waiting to help you at @FirefoxSupport on Twitter and/r/firefox on Reddit.

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

A filter for display name spoofing

  • 2 replies
  • 0 have this problem
  • Last reply by tn

more options

I have been getting some spam/phish emails using Display Name Spoofing of some senders I recognize.

In each case the display name is in my personal address book, but the email address of this spam does not match and is different each time. The people being spoofed are aware this is going on but since the spam emails do not originate from their PCs or sometimes not even their ISPs, there isn't any easy fix on their end.

It would be useful to have an inbox filter that would check the personal address book for known display names and made sure the email address matched. Just highlighting a mismatch would be helpful.

I have been getting some spam/phish emails using Display Name Spoofing of some senders I recognize. In each case the display name is in my personal address book, but the email address of this spam does not match and is different each time. The people being spoofed are aware this is going on but since the spam emails do not originate from their PCs or sometimes not even their ISPs, there isn't any easy fix on their end. It would be useful to have an inbox filter that would check the personal address book for known display names and made sure the email address matched. Just highlighting a mismatch would be helpful.

All Replies (2)

more options

Despite V128 not being offered to all users as yet you can manually download it from Thunderbird.net

The new version displays the display name and email address in the message list. Which appear to me to be what you want

As you can see from the image there are three option available for the way the sender is shown the first being the default.

Alternatively you could use the sending email address and a filter to tag the message where the email address is not in your address book

(Ignore the body line I was in the middle of doing something else)

That would see mail that comes from addresses not in your address book coloured with the tag color. I would think that would be a fairly obvious prompt that you really do not know the sender.

Helpful?

more options

On my desktop, I am on v128 and see full name and address in received emails.

When I compose an email, the display name and address are taken from my address book. I assume that when I receive an email, the display name I see is always controlled by the sender as it is stored in the email header.

The problem is I have not memorized all the email addresses in my address book, but I do recognize the display names. There are a lot of John Smiths in the world which would could make filtering on display name a problem, but I have no duplicate display names currently.

Flagging new addresses is a good general solution as it will certainly catch the display name spoofing without trashing a possible display name duplicate that is legit. I think it would still be useful to be able to filter on display name alone and if it appears in the AB, the received address also matches the stored one. This would more accurately target a spoofing attack.

Something like: If 'From Display Name' is in 'Personal Address Book' And If 'From Address' is not in 'Matched Records' Then perform some action

Helpful?

Ask a question

You must log in to your account to reply to posts. Please start a new question, if you do not have an account yet.