Clean across the board
The domain appears on one or more DNS blocklists used for spam filtering.
MalwareTips analyst · message material
legitimateThis appears to be a legitimate internal employee survey sent via the third-party platform Effectory on behalf of IKEA.
- The sender domain effectory.com is a known survey platform used by many organizations for employee feedback.
- The email content aligns with standard corporate survey templates and does not request sensitive credentials or financial information.
- The DNSBL hit on the sender infrastructure is likely a false positive common for high-volume transactional email services.
This email appears to be a legitimate internal communication. You may proceed with the survey if you are an IKEA employee.
Every scoring adjustment, in dominance order. Shows exactly how we got from 100 to the final trust number.
Why this verdict
100 → 91The scorer starts every address at 100 trust and applies each signal below in turn. Negative deltas are penalties (red), positive deltas are bonuses (emerald). Final clamped trust: 91.
- Listed on 1 DNSBL: URIBL.dnsbl_listed-15
- Domain publishes strong authentication policy: DMARC p=quarantine · SPF hard-fail.spf_hard_fail_policy+11
- AI analyst flagged 5% phishing likelihood (legitimate).ai_phishing_detected-3
- AI analyst flagged 10% spam likelihood.ai_spam_detected-2
Display name, domain reputation, and authentication checks for the From address.
Display-name impersonation
NO BRAND CLAIMThe display name doesn't resemble any of the top phished brands we track — this isn't a brand-impersonation attempt.
Brand-lookalike radar
okNo typosquat or homoglyph match against the top 50 phished brands.
Domain age
timeoutRDAP check did not run.
MX records, deliverability probe, provider classification, and DNS blocklists.
Deliverability
ok- RFC 5322 syntax valid
- 1 MX record publishedeffectory-com.h-v1.mx.microsoft
- SMTP probe · unknown — SMTP probe disabled (set SMTP_PROBE_ENABLED=true to enable)
Provider classification
okNot on our disposable-provider list and not a recognised consumer freemail (Gmail / Outlook / Yahoo etc.) — likely a custom domain.
DNS blocklists
okListed by 1 of 3 blocklists:
Breach history for this address and the structural identity of the sending domain.
Breach exposure (HIBP)
okHIBP_API_KEY not configured