Forged Healthcare Sender Invoice Phishing: DKIM/DMARC Auth Failures

Ethan Andrews@eandrews

•updated Jun 28, 2026•0•0•3

This rule detects invoice-themed phishing emails that impersonate healthcare organizations. It identifies suspicious messages by analyzing email authentication failures (DKIM/DMARC/SPF) and specific delivery conditions like 'compauth=none' or 'reason=451', which are often indicative of phishing campaigns leveraging open redirect services for obfuscation.