This rule flags inbound messages where the sender's display name ends with a 'cc:' or 'CC:' suffix. Attackers use this pattern to impersonate recipients or to imply a relationship to the actual CC/BCC recipients, a tactic frequently seen in BEC (business email compromise) and credential phishing campaigns. The rule triggers on inbound data and applies a display-name suffix check (case-insensitive for the two suffix variants). It is a lightweight heuristic intended to surface suspicious sender identity patterns for further investigation. While useful, there is potential for false positives if legitimate display names inadvertently contain such suffixes, so it should be correlated with additional signals like header alignment (From vs. envelope) and DKIM/DMARC results, and followed by routine investigative actions.