Service abuse: Amazon SES with newly registered reply-to domain

calendar Nov 6, 2026 · Attack surface reduction  ·
Share on: linkedin copy

Detects inbound messages sent through Amazon SES infrastructure where the reply-to address uses a domain different from the sender's domain and that domain was registered within the last 30 days, a strong indicator of disposable infrastructure used to evade detection and redirect replies to attacker-controlled addresses.

Sublime rule (View on GitHub)

 1name: "Service abuse: Amazon SES with newly registered reply-to domain"
 2description: "Detects inbound messages sent through Amazon SES infrastructure where the reply-to address uses a domain different from the sender's domain and that domain was registered within the last 30 days, a strong indicator of disposable infrastructure used to evade detection and redirect replies to attacker-controlled addresses."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and headers.return_path.domain.root_domain in ("amazonses.com")
 8  and any(headers.reply_to,
 9          .email.domain.root_domain != sender.email.domain.root_domain
10          and network.whois(.email.domain).days_old <= 30
11  )  
12tags:
13 - "Attack surface reduction"
14attack_types:
15  - "Spam"
16  - "BEC/Fraud"
17  - "Credential Phishing"
18tactics_and_techniques:
19  - "Spoofing"
20  - "Social engineering"
21detection_methods:
22  - "Header analysis"
23  - "Whois"
24  - "Sender analysis"
25id: "54158d1a-2e67-51b7-840a-b3e1652ae29f"

Related rules

to-top