Fake domain registrar claiming the target's domain expires today or within hours and will be released to the public or acquired by competitors unless renewed immediately — domain-slamming urgency attack; real registrars send expiry notices on a predictable calendar, not same-day-expiry cold emails with competitor-acquisition threats.
domain-expiry-renewal-urgency-phish
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake domain registrar or "domain authority" (impersonating GoDaddy, Namecheap, Cloudflare, Network Solutions, or generic "Domain Services") claiming the target's domain name expires today or within hours and that failure to renew immediately will result in the domain being released to the public or acquired by competitors — same-day-expiry domain-slamming attack. Real domain expiry notices from legitimate registrars arrive on a predictable renewal calendar (typically 30, 15, 7, and 1 day before expiry) from the actual registrar where the domain was registered, verifiable via WHOIS; cold emails claiming "your domain expires TODAY — renew in the next few hours or competitors will acquire it permanently" are domain-slamming, registrar-transfer fraud, or credential-harvest attacks. This variant uses extreme same-day / hours-remaining / competitor-acquisition urgency framing. Distinct from domain-registrar-renewal-phish (batch 14 — 48-hour deadline framing) — this targets the same-day expiry / hours remaining / competitor acquisition / renew immediately pretext. Detection: domain expires today/hours remaining + renew immediately + competitors will acquire vocabulary + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +4. Source: GC1-R29; ICANN domain slamming policy; FTC domain name scam advisory 2025; CISA domain urgency phishing patterns.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started