Marketing & bulk mail
135 signals in this category. Every entry links to a full explanation, severity tier, and false-positive notes.
What most signals in this category mean
Warning signal — bulk / marketing / mild spam. Contributes to the trash score but is not by itself sufficient.
- Abandoned cart reminder (automated e-commerce re-engagement)warning
abandoned-cart-reminder - Adoption process notification (protected)warning
adoption-process-notification - Year in review / annual summary / Wrappedwarning
annual-review-wrapped - API rate limit / quota notificationwarning
api-rate-limit-notification - App update available notificationwarning
app-update-email - Software / app update notificationwarning
app-update-notification - Arabic marketing / عرض خاص / تخفيضاتwarning
arabic-marketing - Data backup / export notificationwarning
backup-export-notification - Birthday marketing offerwarning
birthday-marketing - Bounced / undeliverable mail notificationwarning
bounce-notification - Cart abandonment reminderwarning
cart-abandonment-email - Chinese marketing / 特价 / 优惠warning
chinese-marketing - CI/CD build status notificationwarning
ci-build-notification - Citizenship / naturalization application (protected)warning
citizenship-notification - Comment / @mention notificationwarning
comment-mention-notification - Connection / friend request notificationwarning
connect-request-notification - MIME CID Obfuscationthreat
content-id-mismatch-tracking-beacon - Coupon / promo code emailwarning
coupon-code-email - Dating site spamwarning
dating-site-spam - Debt relief / credit repair spamwarning
debt-collection-spam - Digest with "View all" / "Manage preferences" CTAwarning
digest-view-all-cta - Dutch marketing urgency languagewarning
dutch-marketing-urgency - E-learning / course notificationwarning
education-course-notification - ESP platform unsubscribe linkwarning
esp-platform-unsubscribe - Newsletter platform watermark in footerwarning
esp-watermark-footer - Event reminder (marketing)warning
event-reminder-marketing - Event waitlist notificationwarning
event-waitlist-notification - Fake FedEx "package tracking update — unable to deliver, address verification required" notice sent from a non-FedEx domain demanding click-to-verify via embedded link — credential-harvest and card-skim cross-domain phish. Real FedEx mail originates from fedex.com / e.fedex.com / tracking.fedex.com only.warning
fedex-tracking-cross-domain - Feedback / survey response confirmationwarning
feedback-confirmation - Fintech brand sending promotional newsletter (not transactional)warning
fintech-newsletter - Flash sale / lightning dealwarning
flash-sale-email - Forum / community digest notificationwarning
forum-community-digest - French discount / promotion campaignwarning
french-discount-campaign - French marketing urgency languagewarning
french-marketing-urgency - Gambling/casino spam keywordsthreat
gambling-casino-spam - Gaming / in-game notificationwarning
gaming-notification - German discount / Rabattaktion campaignwarning
german-discount-campaign - German marketing urgency languagewarning
german-marketing-urgency - Gift card / promotional credit / coupon codewarning
gift-card-promo-credit - Gift-card reward subject lurethreat
gift-card-reward-subject-lure - Graduation ceremony notification (protected)warning
graduation-ceremony-notification - Health/pharmaceutical spam keywordsthreat
health-pharma-spam - Hindi marketing / विशेष ऑफर / छूटwarning
hindi-marketing - Smart device / home automationwarning
home-automation-smart-device - Home / building inspection (protected)warning
home-inspection-notification - Inventory / stock level notificationwarning
inventory-stock-notification - Italian discount / sconto campaignwarning
italian-discount-campaign - Italian marketing urgency languagewarning
italian-marketing-urgency - Japanese marketing / セール / キャンペーンwarning
japanese-marketing - Job alert / career notificationwarning
job-alert-notification - Journal / gratitude diary notificationwarning
journal-diary-notification - Jury duty / jury service (protected)warning
jury-duty-notification - Korean marketing / 할인 / 세일warning
korean-marketing - Language learning / Duolingo streakwarning
language-learning-notification - LinkedIn Swedish notificationwarning
linkedin-swedish-notification - Loan / mortgage approval (protected)warning
loan-approval-notification - Loyalty / reward points notificationwarning
loyalty-points-email - Loyalty / rewards program notificationwarning
loyalty-rewards-notification - Marketplace seller/product review requestwarning
marketplace-review-request - Museum / exhibit notificationwarning
museum-exhibit-notification - Music playlist / new album notificationwarning
music-playlist-notification - New follower / subscriber notificationwarning
new-follower-notification - Newsletter archive / past issues linkwarning
newsletter-archive-link - Newsletter sponsor / "Brought to you by"warning
newsletter-sponsor-block - Newsletter with table of contentswarning
newsletter-toc - Nordic marketing platform tracking link (APSIS, Voyado, Rule)warning
nordic-esp-tracking-link - Weekly digest / notification summarywarning
notification-digest-email - NPS / satisfaction survey requestwarning
nps-satisfaction-survey - NPS / recommendation surveywarning
nps-survey-email - Payment failure / card declined notificationwarning
payment-failure-notification - Pension / retirement statement (protected)warning
pension-retirement-notification - Online pharmacy spamthreat
pharma-spam-online-pharmacy - "On this day" / photo memory notificationwarning
photo-memory-notification - External Spy Pixelwarning
pixel-tracker-external-domain - Podcast episode published / now streamingwarning
podcast-episode-published - Podcast guest / interview requestwarning
podcast-guest-request - Podcast download stats / analyticswarning
podcast-hosting-stats - New podcast episode notificationwarning
podcast-new-episode - Podcast rating / review requestwarning
podcast-rating-request - Podcast recommendationwarning
podcast-recommendation - Podcast show notes / episode transcriptwarning
podcast-show-notes - Podcast subscription confirmedwarning
podcast-subscription-confirmed - Polish marketing urgency languagewarning
polish-marketing-urgency - Portuguese discount / desconto campaignwarning
portuguese-discount-campaign - Portuguese marketing urgency languagewarning
portuguese-marketing-urgency - Post-purchase review request with order contextwarning
post-purchase-review-request - Pre-sale / early bird ticketswarning
presale-early-bird - Prescription drug spam — controlled substance offered without prescription + buy-online CTAthreat
prescription-drug-spam - Product review / rating requestwarning
product-review-request - Product recall / safety notice (protected)warning
recall-safety-notification - Recruiter/job platform notification with job keywordswarning
recruiter-platform-notification - Recycling / waste collection notificationwarning
recycling-waste-notification - Referral / invite-a-friend promptwarning
referral-invite-prompt - Referral program / earn rewardswarning
referral-program-email - Church / congregation notification (protected)warning
religious-community-notification - Reply-chain phishing link — forced review (high-confidence)warning
reply-chain-hijack-link-lure-force-review - Post-purchase review / satisfaction survey requestwarning
review-solicitation - Rewards tier / status level changewarning
rewards-tier-change - Russian marketing / скидка / акцияwarning
russian-marketing - SaaS onboarding drip campaignwarning
saas-onboarding-drip - Platform-as-a-Proxy (PaaP) SaaS notification abuse — phishing content (toll-free callback, unauthorized charge, wire-transfer instructions) injected into a user-controlled field of a legitimate SaaS notification (GitHub commit description, Jira invite, Amazon Business invite, Google Calendar event). Email passes SPF/DKIM/DMARC/ARC because the platform itself is the sender. Talos Apr 2026: ~2.89% of GitHub notification email was malicious on a single day; one tracked campaign hit 20,049 orgsthreat
saas-platform-notification-invite-abuse-paap - Google security alert (protected)warning
safety-google-security-notification - Scholarship / financial aid award (protected)warning
scholarship-notification - Seasonal / holiday promotion (Black Friday, etc.)warning
seasonal-holiday-promo - Seasonal / holiday sale promotionwarning
seasonal-marketing - Social platform activity digestwarning
social-digest-notification - Social proof block ("Join 10,000+ companies", "★★★★★")warning
social-proof-marketing - Space / astronomy podcastwarning
space-astronomy-podcast - Known spam mailer tool (PHPMailer, SwiftMailer, etc.)threat
spam-mailer-fingerprint - Spanish marketing urgency languagewarning
spanish-marketing-urgency - Team practice / game schedule (protected)warning
sports-team-notification - List-Unsubscribe + known marketing platform (bulk ESP confirmed)warning
subscription-marketing-convergence - Survey spam with gift card/reward incentivewarning
survey-incentive-spam - Swedish discount/campaign vocabularywarning
swedish-discount-campaign - Swedish marketing urgency phrasewarning
swedish-marketing-urgency - Tax filing deadline reminder (protected)warning
tax-deadline-notification - Team / workspace member notificationwarning
team-workspace-notification - Thai marketing / โปรโมชั่น / ลดราคาwarning
thai-marketing - "Top N" numbered digest formatwarning
top-n-digest - Turkish marketing / indirim / kampanyawarning
turkish-marketing - Union meeting / collective agreement (protected)warning
union-membership-notification - Usage / activity report notificationwarning
usage-report-notification - UTM marketing tracking linkswarning
utm-tracking-params - Fake Vercel / Netlify / Cloudflare-Pages PR-preview env-var exfil click-through lure — "Vercel preview ready — review env scrape route" / "Netlify deploy preview exposes process.env.NEXT_PUBLIC_API_KEY and adds a /api/_debug endpoint dumping the full env." Sender NOT on the canonical preview-deploy / SCM allowlist (vercel.com, vercel.app, netlify.com, netlify.app, cloudflare.com, pages.dev, workers.dev, github.com, githubusercontent.com, githubapp.com, gitlab.com, bitbucket.org, render.com, fly.io, railway.app, heroku.com, firebase.google.com, amplifyapp.com, amazonaws.com). Real preview-deploy notifications come from the canonical preview-deploy vendor and do not advertise env-var exfil endpoints — they link to the verified preview URL and ship from the vendor's no-reply address. Distinct from R7 GHA-disclosure-lure and R8 cloud-build-matrix — this signal is specifically the *PR-preview env exfil* pretext (Vercel deploy-preview workflow where the PR-preview branch exposes `process.env.NEXT_PUBLIC_*` and accidentally leaks server-side env vars via a `/api/_debug` route added in the PR; the lure click-through scrapes the env). Source: Red-Team R8 multi-agent council S1 (supply-chain specialist).threat
vercel-pr-preview-env-exfil-lure - Vote / poll / election notificationwarning
vote-poll-notification - Voter registration / polling notification (protected)warning
voter-registration-notification - Waitlist / early access notificationwarning
waitlist-notification - Warranty claim / replacement (protected)warning
warranty-claim-notification - Warranty expiration / extended warranty spamwarning
warranty-expiration-spam - Weather forecast / daily weatherwarning
weather-forecast-digest - Webinar invitation (marketing)warning
webinar-invitation-email - Weight loss miracle spam — rapid loss claim or fraudulent supplement + buy-now/free-trial CTAthreat
weight-loss-miracle-spam - Weight loss / diet pill spamwarning
weight-loss-spam - Win-back / re-engagement campaignwarning
winback-reengagement - Workspace / project / task notificationwarning
workspace-project-notification
Want to see them in action?
Connect your Gmail in 10 seconds and Gorganizer will show you exactly which signals fired on every email — colour-coded by severity, with full explanations.
Get started