On April 11, 2020 3:08:15 PM EDT, RW <rwmailli...@googlemail.com> wrote:
>On Sat, 11 Apr 2020 19:58:02 +0100
>RW wrote:
>
>
>>
>> The first one was cited as a format used in forwarded ham. The other
>> two are common in spam.
>>
>> The point of this spamming technique is that many clients show only
>> the display name in the message list. Consequently the three headers
>> will display like this:
>>
>> Mr Bill (mb...@legitemail.com)
>> mb...@legitemail.com
>> Mr Bill <mb...@legitemail.com>
>>
>> IMO the middle one is the most convincing as it's exactly what would
>> have been displayed if that address had been used without a display
>> name. The last one at least looks like a from header. The first looks
>> the
>
>... least convincing.
>
Oddly enough the first is legitimate in a lot of cases. Netsuit, for instance,
uses that in the display section all the time.
>I don't know happened there, it got sent before I'd finished.
>
>Basically it seems likely that different formats will has different
>statistics.
>
>There's no need for any of this to be added to any plugin, it's easiest
>to simply meta header regexes with the plugin result.
