Phishing via gasparinutrition.com Abusing Google Workspace with DMARC Fail

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•7

This rule detects potential phishing emails originating from the gasparinutrition.com domain. It identifies suspicious email delivery patterns involving the use of Google Workspace relay (gappssmtp.com) combined with DKIM misalignment and DMARC failures, indicating possible domain spoofing or unauthorized relay usage.