It’s user+ia@gmail.com, and it’s a poor substitute for a dedicated domain. For one, every attacker knows about plus addressing and that those addresses are really all the same email account.