On Sat, 11 Apr 2020 15:16:35 -0400 Rick Cooper wrote: > On April 11, 2020 3:08:15 PM EDT, RW <rwmailli...@googlemail.com> > wrote: > >On Sat, 11 Apr 2020 19:58:02 +0100 > >RW wrote: > > > > > >> > >> The first one was cited as a format used in forwarded ham. The > >> other two are common in spam. > >> > >> The point of this spamming technique is that many clients show only > >> the display name in the message list. Consequently the three > >> headers will display like this: > >> > >> Mr Bill (mb...@legitemail.com) > >> mb...@legitemail.com > >> Mr Bill <mb...@legitemail.com> > >> > >> IMO the middle one is the most convincing as it's exactly what > >> would have been displayed if that address had been used without a > >> display name. The last one at least looks like a from header. The > >> first looks the > > > >... least convincing. > > > > Oddly enough the first is legitimate in a lot of cases. Netsuit, for > instance, uses that in the display section all the time.
Yes, I know. I meant that it's the least convincing in a spam.
