Re: prefix but not actually a reply (thread-hijack phishing)
fake-reply-prefix
What this tier means
Warning signal — bulk / marketing / mild spam. Contributes to the trash score but is not by itself sufficient.
How Gorganizer detects this
Subject starts with a reply prefix (Re:, Sv:, Aw:, or Rép:) but the message is NOT a reply — the In-Reply-To and References headers are both missing. Every legitimate reply originates from a standards-compliant mail client (Gmail, Outlook, Apple Mail, Thunderbird) that sets those headers automatically. A Re:-prefixed subject without them is a deliberate thread-hijack attempt: the attacker borrows the trust halo of a fake conversation to increase click-through on a phishing or spam payload. Fwd: is deliberately excluded from this detection because users occasionally type "Fwd:" into a fresh compose when pasting forwarded content manually.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a warning-tier signal — bulk / marketing / mild spam. It contributes to the trash score but never triggers deletion on its own. Gorganizer requires multiple signals + a margin over the safety floor before any email is moved to trash.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started