Skip to main content
WarningSubject line

Subject contains a literal email address — fake-conversation shape, not a real reply

subject-contains-email-address

What this tier means

Warning signal — bulk / marketing / mild spam. Contributes to the trash score but is not by itself sufficient.

How Gorganizer detects this

The subject line contains a literal email address (e.g. `Re: Payment for john@acme.com — action required`). Phishers embed an address — usually the victim's own, or a plausible corporate one — to fake a threaded-conversation shape so the email feels personal and invites trust. Legitimate transactional email almost never puts a raw address in the subject; companies reference "your account" or an order number instead. Detection is guarded against three false-positive classes: it does not fire on actual replies or forwards (subjects starting with Re:/Fwd:/Sv:/Aw:/etc. are excluded — genuine conversation threads legitimately carry addresses from the original message into the subject), it does not fire when the address is an automation mailer local-part (`noreply@`, `no-reply@`, `donotreply@`, `mailer-daemon@`, `postmaster@`, `bounce@`, `notifications@`, `alerts@` — legitimate bug trackers and CI systems sometimes route via these), and the email regex requires a proper TLD of 2-24 chars so random `@` characters in punctuation don't match. Weight: +3, pairs with other signals (urgency, display-name-spoof) rather than solo-triggering.

False-positive guard

Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a warning-tier signal — bulk / marketing / mild spam. It contributes to the trash score but never triggers deletion on its own. Gorganizer requires multiple signals + a margin over the safety floor before any email is moved to trash.

About the scoring engine

Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.

Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.

Ready to clean your inbox?

Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.

Get started