{"success":true,"data":{"id":"cross-domain-reply-injection","label":"Reply-To, From, and In-Reply-To all use different domains","description":"The In-Reply-To header domain, From domain, and Reply-To domain are ALL different. This triple mismatch indicates thread injection — an attacker is inserting a message into an existing email thread from an unrelated sender, with replies redirected to yet another domain. Legitimate email services maintain domain consistency across these headers.","tier":"danger","category":"other","isThin":false}}