How is this spam hiding from mutt search?
Ofer Inbar
cos at aaaaa.org
Tue Feb 1 21:09:55 UTC 2022
On Tue, Feb 01, 2022 at 10:16:51AM -0800,
"Kevin J. McCarthy" <kevin at 8t8.us> wrote:
> On Tue, Feb 01, 2022 at 10:36:29AM -0500, Ofer Inbar wrote:
> >From: "WeTeachSex" <support_id:8234748 at fMkSSuVRXj.com>
>
> >One feature they all share is that "support_id:" prefix in the fake
> >email address.
>
> The ':' isn't allowed in the address local part, so I believe the
> mutt parser is rejecting the email address. Because of that there
> is no address stored in the "from" list internally.
>
> You may have to use something like ~h or =h to find the prefix.
Thanks, that's probably it. And ~h works, though it's much slower.
-- Cos
More information about the Mutt-users
mailing list