{"success":true,"data":{"id":"fake-reply-prefix","label":"Re: prefix but not actually a reply (thread-hijack phishing)","description":"Subject starts with a reply prefix (Re:, Sv:, Aw:, or Rép:) but the message is NOT a reply — the In-Reply-To and References headers are both missing. Every legitimate reply originates from a standards-compliant mail client (Gmail, Outlook, Apple Mail, Thunderbird) that sets those headers automatically. A Re:-prefixed subject without them is a deliberate thread-hijack attempt: the attacker borrows the trust halo of a fake conversation to increase click-through on a phishing or spam payload. Fwd: is deliberately excluded from this detection because users occasionally type \"Fwd:\" into a fresh compose when pasting forwarded content manually.","tier":"warning","category":"scam","isThin":false}}