Fake cloud-storage overage lure — "your iCloud / Google Drive / OneDrive / Dropbox is 95% full, upgrade now" from non-vendor sender, credential-harvest on the upgrade link (2024-2025 Q4 iCloud-heavy consumer campaigns)
cloud-storage-overage-lure
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake "your iCloud / Google Drive / Microsoft OneDrive / Dropbox / Box / pCloud / Mega / Photos Library is 95% full — upgrade now" email from a non-vendor sender. High-volume consumer-targeting campaign documented continuously through 2024-2025 in Abnormal Security, Proofpoint, and BleepingComputer feeds; the iCloud variant spikes every Q4 as users' Photos libraries fill up. The "upgrade" link lands on a credential-harvest page replicating the targeted service's login screen. Fires when the body references a specific cloud-storage product (iCloud, Google Drive, OneDrive, Dropbox, Box, Mega, pCloud, Photos Library, Google Photos, Google One) OR generic "cloud storage / cloud backup" AND contains overage / capacity-urgency language (nearly full, almost full, 9X% full, storage limit / quota exceeded, running out of space, upgrade your storage, buy more storage) AND the sender is not a known cloud-storage vendor (apple.com, icloud.com, google.com, microsoft.com, onedrive.com, dropbox.com, box.com, mega.nz, pcloud.com, idrive.com, backblaze.com, sync.com, tresorit.com, nextcloud.com, owncloud.com). Auto-classified as danger via the `-lure` suffix.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started