Gmail Sender with Multiple Display Names

Benjamin Zulliger@benscha

•updated Oct 22, 2025•18•4•600

Detects a single Gmail sender address using multiple distinct display names within a short timeframe (1 hour). This behavior can indicate an attempt at impersonation, phishing, or spam campaigns where an attacker tries to appear as different entities from the same compromised or controlled email account.