Email Spoofing via Mismatched From and Return-Path

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects email spoofing attempts where the 'From' address domain does not match the 'Return-Path' address domain. It specifically looks for SMTP traffic on port 25, ensuring the flow is established and to the server. The rule uses PCRE to extract the domain from the 'From' header and then checks if the 'Return-Path' header contains a different domain.