Confirmed scam — delete it
The domain doesn't publish MX records, so mail to this address can't be delivered.
MalwareTips analyst · message material
tech_support_scamThis email uses a fake support address and urgent threats of account termination to solicit contact via a suspicious phone number.
- Uses a non-official sender domain that does not belong to PayPal.
- Employs high-pressure tactics by threatening account termination within 24 hours.
- Contains significant grammatical errors and typos inconsistent with official corporate communications.
- Directs the user to call an unverified phone number rather than using official support channels.
- Fails all email authentication checks including SPF and DMARC.
Do not call the provided phone number or reply to the email. Delete the message immediately and report it to your email provider.
Every scoring adjustment, in dominance order. Shows exactly how we got from 100 to the final trust number.
Why this verdict
100 → 0The scorer starts every address at 100 trust and applies each signal below in turn. Negative deltas are penalties (red), positive deltas are bonuses (emerald). Final clamped trust: 0.
- No MX records at all — the domain can't legitimately send mail.no_mx_records-55
- AI analyst flagged 95% phishing likelihood (tech_support_scam).ai_phishing_detected-48
- Listed on 1 DNSBL: URIBL.dnsbl_listed-15
- Message body triggered 1 rule-based red-flag category (credential-harvest / urgency / attachment-bait / money-movement / etc.).body_red_flags-8
- Domain publishes strong authentication policy: no DMARC published · SPF hard-fail.auth_dns_published+4
Display name, domain reputation, and authentication checks for the From address.
Display-name impersonation
NO BRAND CLAIMThe display name doesn't resemble any of the top phished brands we track — this isn't a brand-impersonation attempt.
Brand-lookalike radar
okNo typosquat or homoglyph match against the top 50 phished brands.
Domain age
errorRDAP check did not run.
Signals extracted from the message body, embedded URLs, and uploaded screenshot.
Phishing-pattern signals
1 signalRule-based pattern matches we ran across the message body and OCR text BEFORE the AI analyst. Each is a hint, not a verdict.
- Uses urgency or time pressuremedium“send to. After 24 hours your account will be terminated Need help ? Support at Paypa”
MX records, deliverability probe, provider classification, and DNS blocklists.
Deliverability
ok- RFC 5322 syntax valid
- No MX or A/AAAA records found.(implicit A record)
- SMTP probe · unknown — SMTP probe disabled (set SMTP_PROBE_ENABLED=true to enable)
Provider classification
okNot on our disposable-provider list and not a recognised consumer freemail (Gmail / Outlook / Yahoo etc.) — likely a custom domain.
DNS blocklists
okListed by 1 of 3 blocklists:
Breach history for this address and the structural identity of the sending domain.
Breach exposure (HIBP)
okHIBP_API_KEY not configured