Confirmed scam — delete it

Fake antivirus renewal scam using urgency and bogus account details to trick you into activating a subscription.

Subject·Payment Failure: Antivirus and privacy protection

Body-only scan — sender identity and infrastructure checks are unavailable.Re-scan with sender

At a glance

AI · 90% phishingTech Support Scam5 red flags

Risk score

100

/ 100

malicious

AI analyst

MalwareTips analyst · message material

tech_support_scam

Fake antivirus renewal scam using urgency and bogus account details to trick you into activating a subscription.

Phishing likelihood90%

Spam likelihood10%

Red flags identified

Suspicious from-domain ihnerebbnfjts.us obscured via random jonathan-buch.de.
High urgency with 'Final Reminder' and 'expires today' to pressure immediate action.
Fake reference code XJB66PJ7A and account ID [number] impersonate legitimate billing.
'Activate Now' call-to-action without visible URL likely leads to malware or payment theft.
No authentication results provided for sender.

What to do

Do not click activate or respond. Delete the email and report it to your provider as phishing.

Why this verdict

Every scoring adjustment, in dominance order. Shows exactly how we got from 100 to the final trust number.

Why this verdict

skipped

This report was generated before the per-signal breakdown was available. Rescan this address to see the full score log.

Unlock more checks

Paste the sender to unlock identity + infrastructure analysis

This scan analysed the message body only. Adding the sender address, a Gmail Name <a@b.com> line, or full headers unlocks:

Display-name impersonation
Spot mismatched names like "PayPal Support" on a random Gmail.
SPF · DKIM · DMARC
See whether the sending server is authorised to use that domain.
Domain age + registrar
Brand-new domains are one of the strongest phish signals.
Breach exposure
How many known data breaches this specific address appears in.
MX + DNSBL reputation
Whether the domain can even receive mail and if it's on any blocklists.

Add sender and re-scan

Your previous paste won't be sent — you'll start a fresh scan with both fields.

Scanned by

JackStaff

Scan another

Check a different email address

URL instead?

Check if a link is safe

This report URL contains a SHA-256 hash, while the cached report retains normalized sender components, display name when available, and derived evidence. Raw .eml and screenshot bytes are discarded after extraction. The page is noindex, but anyone with the link may be able to view it; do not submit secrets or confidential messages. If you received this email and are worried, do not click any links and do not reply — verify the sender through a known-good channel.