How is this spam hiding from mutt search?

Ofer Inbar cos at aaaaa.org
Tue Feb 1 21:09:55 UTC 2022


On Tue, Feb 01, 2022 at 10:16:51AM -0800,
"Kevin J. McCarthy" <kevin at 8t8.us> wrote:
> On Tue, Feb 01, 2022 at 10:36:29AM -0500, Ofer Inbar wrote:
> >From: "WeTeachSex"   <support_id:8234748 at fMkSSuVRXj.com>
> 
> >One feature they all share is that "support_id:" prefix in the fake
> >email address.
> 
> The ':' isn't allowed in the address local part, so I believe the
> mutt parser is rejecting the email address.  Because of that there
> is no address stored in the "from" list internally.
> 
> You may have to use something like ~h or =h to find the prefix.

Thanks, that's probably it.  And ~h works, though it's much slower.
  -- Cos


More information about the Mutt-users mailing list