Body has a mailto: link to a different domain than the sender — reply-funnel scam shape
href-mailto-cross-domain
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
The email body contains a `<a href="mailto:X@Y">` link where the mailto address domain Y is different from the sender's From-header domain. This is the canonical reply-funnel scam pattern: a teaser email with a CTA saying "email me at scammer@gmail.com to learn more" — the goal is to move the conversation off the structured mail filter and into a 1-on-1 channel where social engineering is harder for downstream filters to catch. Real businesses link to mailto only with their own corporate domain (sales@company.com next to a from address ending in @company.com). The cross-domain mailto pattern is essentially diagnostic of the reply-funnel shape — legitimate "reach out via this address" emails use the same domain. Weighted at +3, pairs well with other reply-funnel signals (free-webmail sender, urgency-bait subject, telegram-handle in body) without being solo-decisive.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started