Re: How is this spam hiding from mutt search?

On Tue, Feb 01, 2022 at 10:16:51AM -0800, Kevin J. McCarthy wrote: > On Tue, Feb 01, 2022 at 10:36:29AM -0500, Ofer Inbar wrote: >> One feature they all share is that "support_id:" prefix in the fake >> email address. > > The ':' isn't allowed in the address local part, so I believe the mutt >

Re: How is this spam hiding from mutt search?

On Tue, Feb 01, 2022 at 10:16:51AM -0800, "Kevin J. McCarthy" wrote: > On Tue, Feb 01, 2022 at 10:36:29AM -0500, Ofer Inbar wrote: > >From: "WeTeachSex" > > >One feature they all share is that "support_id:" prefix in the fake > >email address. > > The ':' isn't allowed in the address local

Re: How is this spam hiding from mutt search?

On Tue, Feb 01, 2022 at 10:36:29AM -0500, Ofer Inbar wrote: From: "WeTeachSex" One feature they all share is that "support_id:" prefix in the fake email address. The ':' isn't allowed in the address local part, so I believe the mutt parser is rejecting the email address. Because of

How is this spam hiding from mutt search?

I've been getting occasional spam recently that follows a common pattern in the From: header. Below is the full header section of one of these emails, as an example: -- >From MAILER-DAEMON Tue Feb 1 10:20:50 2022 Return-Path: