At the time of writing Thunderbird regards e-mail as a scam based on the following criteria:
- Links that only use an IP address, including dotted decimal, octal, hex, dword, or some mixed encoding.
- Links that claim to go to one site, but actually go to another. (Phishers do this to fool you into going to their site. Legit mailing lists sometimes do this with redirectors for tracking purposes.)
- Forms embedded in the email.