I received a spam and the field "From" looks like this (I have anonymized the field):
John Doe <email@example.com> John Doe [mailto:firstname.lastname@example.org]
- How this field has been built? The information in bold corresponds to what?
- Which rule can I implement to block it? Example: If an email address between square brackets is indicated AND it doesn't match the email address indicated between angle bracket then refuse the email?
I suppose that the "true" email of the sender is
email@example.com but usually only the two first pieces of information are showed in the field "From" (the display name and the <email address>).