Unfamiliar with all color codes, not a function used often. Search query varies based on desired results. Phishing emails can be handled differently per organization, but should generally have the email removed from the environment to protect the end-users.