Sender / domain
22 signals in this category. Every entry links to a full explanation, severity tier, and false-positive notes.
- AI-generated invoice BEC with lookalike domain — plausible invoice from a typosquat vendor domain with changed banking / wire-transfer details mid-transaction. Abnormal Security 2025-2026; FBI IC3 2025 BEC $2.9B; distinct from fake-invoice-callback (phone-number shape).warning
ai-generated-invoice-bec-lookalike-domain - Automated sender address (notifications@, alerts@, etc.)warning
automated-sender-prefix - BIMI logo checkmark on lookalike phishing domain (brand impersonation via VMC certificate)threat
bimi-on-lookalike-domain - Deep subdomain (click-tracking infrastructure)warning
deep-subdomain-sender - Display name is an email address (impersonation)threat
display-name-contains-email - From display name contains an emojiwarning
display-name-contains-emoji - URL in From display name — inbox-column clickbaitthreat
display-name-contains-url - Spoofed Display Namethreat
display-name-escaped-angle-brackets - Display-name executive impersonation — C-suite title in from name + freemail senderthreat
display-name-executive-impersonation - From display name mixes Latin with Cyrillic/Greek (homograph)threat
display-name-mixed-script - Empty or missing From header — no legitimate sender produces this shapewarning
empty-from-header - From display name is only digits / punctuation — spam fingerprintwarning
from-display-name-only-digits - Sender domain is a raw IP address (spam infrastructure)threat
from-domain-is-ip - Marketing platformwarning
marketing-platform-signal - Known Nordic bulk sender missing List-Unsubscribewarning
nordic-bulk-sender - Personal name on no-reply addresswarning
noreply-personal-display-name - No-reply addresswarning
noreply-sender - Automated sender (numeric address)warning
numeric-only-sender - Punycode/IDN domain (homograph attack)threat
punycode-domain - From display name is all-caps multi-word — scare-tactic spam fingerprint ("URGENT ACCOUNT UPDATE")warning
sender-display-name-all-caps - Residential-IP sender claiming corporate auth posturethreat
sender-ip-residential-claim-corporate - Sent via Amazon SESwarning
ses-bulk-indicator
Want to see them in action?
Connect your Gmail in 10 seconds and Gorganizer will show you exactly which signals fired on every email — colour-coded by severity, with full explanations.
Get started