On Sat, 11 Apr 2020 19:58:02 +0100 RW wrote:
> > The first one was cited as a format used in forwarded ham. The other > two are common in spam. > > The point of this spamming technique is that many clients show only > the display name in the message list. Consequently the three headers > will display like this: > > Mr Bill (mb...@legitemail.com) > mb...@legitemail.com > Mr Bill <mb...@legitemail.com> > > IMO the middle one is the most convincing as it's exactly what would > have been displayed if that address had been used without a display > name. The last one at least looks like a from header. The first looks > the ... least convincing. I don't know happened there, it got sent before I'd finished. Basically it seems likely that different formats will has different statistics. There's no need for any of this to be added to any plugin, it's easiest to simply meta header regexes with the plugin result.
