Technically detects inbound mail messages where the Mailer header contains a randomly generated alphanumeric string prefixed by 'Mailer-' (Mailer-[a-z0-9]{6,12}). This pattern is characteristic of bulk mailer tooling used in fraud campaigns. The rule leverages header analysis and sender analysis to flag messages that rotate sender addresses and domains while reusing a common fake subject (e.g., ACH payment disbursement / order status) to lure recipients. When triggered, alerts help identify credential harvesting and business email compromise attempts (BEC/Phishing) that rely on social engineering and spoofing to bypass sender-based filters. The rule's taxonomy includes Social engineering, Spoofing, and Evasion; detection sources rely on inbound header data and sender identity data, and the primary data source is Network Traffic. The attack types associated are Credential Phishing and BEC/Fraud. This rule complements SPF/DKIM checks and can be enriched with reputation data and DMARC results to reduce false positives.