{"success":true,"data":{"id":"reply-to-multiple-addresses","label":"Reply-To header has multiple addresses — harvest-ring fan-out","description":"The Reply-To header contains two or more email addresses separated by commas. RFC 5322 permits this, but legitimate transactional and marketing email essentially never uses it. Attackers set multiple Reply-To addresses so a victim's reply fans out to a harvesting ring — every address on the list gets the reply simultaneously. The most dangerous shape is `sender@legit.com, attacker@harvester.xyz` where one address matches the From domain, hiding the attack from single-address Reply-To checks that only inspect the first address. Detection counts `@` symbols; two or more means multi-address.","tier":"danger","category":"header","isThin":false}}