Skip to main content
ThreatOther

Date header skewed ≥12h from delivery time (spam staging)

header-date-future-skew

What this tier means

High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.

How Gorganizer detects this

The `Date:` header timestamp is more than 12 hours away from the Gmail API's authoritative delivery timestamp (`msg.date`). Spam staging tools manipulate the Date header in two ways: (1) far-future dates — pushing the message to the top of inbox sort-by-date views, increasing open rates before the user realises it was manufactured; (2) far-past dates — making the email appear old so time-based filter rules that only watch recent mail skip over it. Every legitimate MTA (Postfix, Exim, Gmail, Microsoft SMTP, the major ESPs) stamps Date: within seconds of actual submission — network latency and clock drift never account for a 12-hour gap. The guard compares raw `headers['date']` against `msg.date` using `Math.abs(parsedDateHeader - parsedMsgDate) > 12 * 60 * 60 * 1000`. Does not fire for strict_invoice / strict_work / strict_shopping sender types. Weighted at +2 — not solo-decisive but pairs well with other structural spam signals.

False-positive guard

Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.

About the scoring engine

Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.

Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.

Ready to clean your inbox?

Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.

Get started