"This email might be a phishing attempt" - not always correct

[ckruetze]

Steps to reproduce

1. Get an external mail that has a link with the following format in it: href: http://www.example-domain.de/ link text: example-domain.de

Expected behavior

This should not trigger a warning at all. the http:// part should be ignored and also a www. should be ignored as it is very common to have that. Additionally in the above example the e-mails are coming in from [email protected] The external user is in the internal contacts list and is a frequent person used for e-mails both incoming and outgoing There should be additional checks that if the domain is used frequently or even in contacts links should not be marked as potential spam as that confuses the users.

Actual behavior

We get the warning "This email might be a phishing attempt "

Mail app version

?

Nextcloud version

31.0.1 RC2

Mailserver or service

?

Operating system

Linux

PHP engine version

None

Nextcloud memory caching

No response

Web server

None

Database

None

Additional info

none

[kesselb]

Thanks for reaching out 👍

This should not trigger a warning at all. the http:// part should be ignored and also a www. should be ignored as it is very common to have that.

We remove the protocol part, but "www" affects the meaning. I'll check if we can ignore "www" by default. Remember, spammers use this too.

additional checks that if the domain is used frequently or even in contacts links should not be marked as potential spam as that confuses the users.

We have trusted senders and internal addresses. Did you add the sender as trusted sender?

[ckruetze]

OK, this might be a really silly question, but how would I add a sender to be a trusted sender? And how do I check if a sender is a trusted sender?

[ckruetze]

We remove the protocol part, but "www" affects the meaning. I'll check if we can ignore "www" by default. Remember, spammers use this too.

How would a spammer do that? I can understand it if it is one of those domains that allowes third parties to add subdomains like IamNotaSpammer.somedomain.com but www ? If you give a third party access to your www domain something else is wrong.

[kesselb]

Sorry, that was unclear. A phishing warning is triggered when the link and link text differ. Spammers use this technique to deceive people. I think it's fine to drop "www" by default, but senders should improve their emails to avoid using the same odd semantics as spammers.

Trusted Senders: In Nextcloud Mail, HTML emails with images are not loaded by default. You can add recipients or domains to always load images, which is called "trusted senders."

I'll log a feature request to include trusted senders and internal addresses in the phishing detection. I'll also keep this report open to tweak the link-text comparison a bit.

Thanks again for bringing it to our attention.

[thstyl2000]

The protocol part is not always correctly removed:

Maybe the trailing slash is the culprit...?

(Mail version 5.1.5, php8.2)

[hamza221]

The protocol part is not always correctly removed:

Maybe the trailing slash is the culprit...?

(Mail version 5.1.5, php8.2)

the protocol part is removed while comparing https://github.com/nextcloud/mail/blob/2580455600643148e7b904621c10527a40389365/lib/Service/PhishingDetection/LinkCheck.php#L80 But it still shows in the warning, you're getting a warning here because the href is missing www.

[CreatorOfBiontium]

And how about that www? I do think, that it can be ignored while comparing (and handle cases like www.www.subdomainregisterer.net)