{"success":true,"data":{"id":"display-name-contains-url","label":"URL in From display name — inbox-column clickbait","description":"The From header's display name contains a URL or URL-shortener host — e.g. `\"Click bit.ly/free-gift\" <spam@attacker>`. Mail clients render the display name prominently in the inbox \"From\" column, and some clients even linkify URL-shaped display names, so the user can click straight from the inbox list into the attacker's landing page. Legitimate senders never put URLs in display names. Detection is scoped to the display name and requires either an `https?://` prefix OR a known shortener host — dot-separated names like \"J.R. Doe\" and prose like \"Accounting Communications\" don't false-fire.","tier":"danger","category":"sender","isThin":false}}