Unwanted email arriving using Thunderbird email client

Topic

New Reply

I’ve been using T’bird for email for more than a decade and the situation I’ll describe began about two/three weeks ago.  T’bird is up to date and has been an excellent performer for me with no security problems ever.  I’ve changed some privacy/security settings with T’bird to attempt to block the problem emails as well as adjusting the junk mail settings too.  That has not stopped the mails.

I’d sure appreciate your advice and background about this email sender and how to block the mail coming from it.  An IP lookup indicated the ISP to be Sparkpost residing in a couple of locations in the USA.

What changes or settings would you suggest to apply in an attempt to block this unwanted mail?

Thank you in advance for checking this out and advice you may supply.

I’m now getting two, sometimes three emails a day from this source:

The ip is 156.70.24.80

Received: from 127.0.0.1
by atlas-sbc-production.v2-mail-prod1-bf1.omega.yahoo.com pod-id atlas--sbc-production-bf1-79688f78cf-4z2q7.bf1.yahoo.com with HTTP; Sat, 13 May 2023 22:47:03 +0000
Return-Path: <msprvs1=19497lFSOuPsk=bounces-296858-4@b.n2.funnyeditor.com>

Received-SPF: pass (domain of b.n2.funnyeditor.com designates 156.70.24.80 as permitted sender)

Reply | Quote

Replies

In addition to using T’Bird’s built-in junk filtering engine (that you can train to recognize most junk mail, but you probably knew that), which it sounds like you’ve already been doing, it sounds like it’s time to report that individual sender as unwanted s**m to your email provider/ISP using their procedures or special email address, OR, only if you’re comfortable doing so, go find another email provider if your current one doesn’t give you any satisfaction in helping reduce the amount of unwanted s**m you seem to suddenly be receiving.

Also it could be that, if you’re suddenly getting this junk when you’ve hardly gotten any at all from any other address in the past, someone who has your email address has gotten themselves infected with a piece of crapware that’s harvested their entire address book. This can happen with businesses as well as individuals.

I hope this helps!

1 user thanked author for this post.

kandb

Reply | Quote

Man, I don’t want to toss T’bird yet.  It’s by far done the job all of the years I’ve used it and your remark about someone/business I may correspond with having a compromised account is very possible.

I forgot to include in the original post that T’bird does not have an option for blocking email messages from specific people or domains but does have a message filter one can create which I’ve done.  I’ll be seeing how that works…

Reply | Quote

When I said to possibly change email providers, I didn’t mean to dump T’Bird for another email program, I meant for you to look for another provider of email service, such as going from your ISP’s email service to GMail or from Yahoo to Proton Mail, for example. My sincerest apologies for any misunderstanding you may have had.

I’ve used T’Bird since just after its’ inception, so it’s been a long time. T’Bird has a way of training it to spot most junk email and put that email in a folder labeled Junk. In case you haven’t set it up (or if you have, then the following is for those who haven’t but would like to know how to set it up) go to Tools>Settings (NOT to be confused with Tools>Account Settings). If you don’t have the drop-down menus set up, then click on the “hamburger”-looking icon (three horizontal lines) and then select “Settings” from that list. Please DON’T select the item that says “Account Settings”.

Now, click on the item on the left-hand side of the window that says “Privacy & Security and scroll down that page until you see a heading that says, simply, “Junk”. Here you will find the settings needed to enable T’Bird’s own built-in junk filter that is trainable. Select the items you feel fit your own needs here. This group is the default settings for the entire program. There are more account-specific settings within the Account Settings selection within T’Bird.

For the Account Settings area, select “Account Settings” from the aforementioned “hamburger”-looking menu. Once you’re in the Account Settings area, simply highlight the account whose settings you want to change and then click on “Junk Settings” under that specific account. Read all descriptions on this page carefully before making any selections. Once you’ve made any selections, they’re instantaneous, no need to click an “OK” button!

@kandb , it sounds as if you’ve already done at least half if the above steps, so maybe take a look and see if there are any remaining ones you might need to do, based upon your own preferences.

1 user thanked author for this post.

kandb

Reply | Quote

Thanks, Bob99.  Good to know you are a longtime T’bird user also.  You know what to expect from it.  I went over your post to be sure I haven’t missed any suggestions and I’m as done as can be at this time.

Reply | Quote

There is nothing you can do to stop this spammer apart from waiting for the various anti spam systems on mail servers / their ISP to block them.
In the meantime you can only mark the mail as junk and let TB do its best to catch them.

Out of interest, is the sender IP / ISP the same as someone you normally get mail from? If so your correspondent may have an infected machine.

cheers, Paul

1 user thanked author for this post.

kandb

Reply | Quote

So, it looks like FunnyEditor is one of those annoying joke email senders. And based on the SPF check passing, they use the SparkPost marketing email service.

Something interesting I found about FunnyEditor is that signing up doesn’t appear to require any sort of confirmation. Enter any email address and the site just says “thanks” – no “check your inbox for a confirmation link” or similar. They apparently don’t care if the email address actually belongs to the person who entered it. Also, they have no abuse reporting or unsubscribe information on their site.

Meanwhile, SparkPost says they are anti-spam, and do provide abuse reporting info on their site: https://staging.sparkpost.com/report-abuse/.

I’d bet SparkPost actually gets blacklisted occasionally due something sent by a client company, and then must jump through hoops laid out by the blacklist owner to get removed. Then they would hopefully also have a stern conversation with the offending client. After all, if they end up on several blacklists, messages from all of their clients could be blocked by lots of email providers, rendering their service useless.

So, you could try reporting abuse to SparkPost. It’s not like doing so would make things worse – they already have your email address.

2 users thanked author for this post.

kandb, b

Reply | Quote

Hello SB9K,

Thank you for the help.  I opened the link you included and will see what is said after I finish this paragraph.  Today I found one bogus mail in the inbox but thanks to T’bird’s filter it was in the Junk folder when I saw it for the first time and flagged that Thunderbird thought it was suspect.  Apparently I’ve got the privacy/security settings and filter set up properly and like my live trap the door snaps shut when the intruder enters.  I shall keep watching and see what happens in the coming week.

Follow up:  The Sparkpost web page and some of it’s links (which there are many) reads very legit to me including how to report abuse.  It could be as you wrote that the turds at FunnyEditor are using Sparkpost as their vehicle to mess with us.

Bill T

Reply | Quote

Paul T wrote:

Out of interest, is the sender IP / ISP the same as someone you normally get mail from? If so your correspondent may have an infected machine.

Likewise, Paul.  Cheers to you.  I do not recognize the IP, not that I will and the ISP is Sparkpost which I also do not recognize from any email received in my years of using email; sending or receiving.  Thank you for checking in.

 

Reply | Quote

If you wish to trace emails, use this link:
https://whatismyipaddress.com/trace-email

1 user thanked author for this post.

kandb

Reply | Quote

Hello Kirsty and thanks for responding.  Currently the T’bird message filter system is doing the job of routing the bogus mails to my junk folder.  But as always, there’s a slight kink in that the spammer(s) will change their address ever so slightly by a number or letter or two which will then cause me to have to create a new filter form in order to catch mail coming from the adjusted address.  I have four separate forms since the past weekend with a couple of them holding more than one mail.  It takes but a minute or so to fill in the necessary blocks on the form but it’s such a cumulative waste of everyone’s time who is caught up with this crap no matter the mail client involved.

Also, T’bird users do have the ability to view the message source when using Thunderbird which is helpful and appreciated.  I will check out your provided link.

Bill T

Reply | Quote

It’s that TB message source that Trace Email uses

1 user thanked author for this post.

kandb

Reply | Quote

I did link to whatismyipaddress.com/trace-email and the site did what it says it will do.  Opened the message source in TB and entered the info from a spam mail into whatismyipaddress.com/trace-email and… voila!

I had checked the IP last Sunday using the TB message source and found the address to be Columbia, Maryland which was verified via the link above now.  The Blacklist Check is good/helpful information too.  Thanks again.

Bill

1 user thanked author for this post.

Kirsty

Reply | Quote