How is this spam hiding from mutt search?

Tue Feb 1 18:16:51 UTC 2022

On Tue, Feb 01, 2022 at 10:36:29AM -0500, Ofer Inbar wrote:
>From: "WeTeachSex"   <support_id:8234748 at fMkSSuVRXj.com>

>One feature they all share is that "support_id:" prefix in the fake
>email address.

The ':' isn't allowed in the address local part, so I believe the mutt 
parser is rejecting the email address.  Because of that there is no 
address stored in the "from" list internally.

You may have to use something like ~h or =h to find the prefix.

-- 
Kevin J. McCarthy
GPG Fingerprint: 8975 A9B3 3AA3 7910 385C  5308 ADEF 7684 8031 6BDA
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.mutt.org/pipermail/mutt-users/attachments/20220201/78042ce1/attachment.asc>