From, Reply-To and Return-Path: what the mismatches reveal

A message has more than one address buried in it, and comparing them is one of the most revealing parts of a forensic analysis.

• From — the sender shown in your inbox.
• Reply-To — where a reply is actually sent when you hit reply.
• Return-Path (envelope sender) — where delivery failures and bounces go; this is the address the mail servers really used.

In genuine mail these line up or differ only in harmless, explainable ways. In malicious mail they frequently diverge:

• A Reply-To pointing somewhere different from From is a classic redirection trick — your reply reaches the attacker, not the person you think you are answering.
• A Return-Path on an unrelated domain often exposes the real sending account behind a spoofed From.

The report highlights every mismatch and explains what it tells us about who actually sent the message and where they wanted your response to go.