Detects inbound emails delivered via Amazon SES infrastructure where the reply-to address uses a domain different from the sender's domain and that reply-to domain was registered within the last 30 days. This combination indicates potential disposable infrastructure and attacker-controlled reply paths used to bypass sender-domain alignment and redirect responses to phishing/BEC attempts. The rule checks: the return_path domain root is amazonses.com, and any reply_to header that points to a different root domain from the sender's domain, with a WHOIS-based age check showing the domain is <= 30 days old. If matched, generate a medium severity alert with detections explaining spoofed reply-to and fresh-domain usage. Tactics include spoofing and social engineering; Attack types include Spam, BEC/Fraud, Credential Phishing. Data sources include inbound message headers and WHOIS lookups, and detection methods include header analysis and domain-age lookup. The rule is applicable to cloud-based SES usage, where legitimate SES metadata can be abused by threat actors.