{"success":true,"data":{"id":"reply-to-corporate-to-freemail","label":"Reply-To routes corporate sender to free webmail — payroll/vendor/CEO fraud signature","description":"From address is on a corporate domain but Reply-To routes replies to a free webmail address (gmail, outlook, yahoo, protonmail, etc.). The attacker compromised or spoofed the corporate sender and wants the victim's reply to land in a personal mailbox they actually control — classic payroll-diversion fraud, vendor impersonation, and CEO-wire-fraud signature. Corporate senders never legitimately route replies to gmail: they use their own corporate domain for both From and Reply-To.","tier":"danger","category":"header","isThin":false}}