Confirmed scam — delete it
Our AI analyst read the message body and judged it likely to be phishing.
MalwareTips analyst · message material
credential_theftThis email pushes a fake survey for a Dutch trade fair using a template with visible debug labels and a suspicious hidden-link button.
- Visible debug labels like logoheader, bannerfooter, and logofooter reveal a phishing template with unstripped development artifacts.
- Spamhaus DBL listing flags the sending domain as blocked for abuse.
- No sender or header information is displayed, hiding the true origin.
- Black 'Klik hier' button lacks a visible URL, typical of phishing lures.
- No RDAP record exists for the domain, indicating suspicious infrastructure.
Do not click the button or reply. Delete the email and forward it to reportphishing@apwg.org for analysis.
Every scoring adjustment, in dominance order. Shows exactly how we got from 100 to the final trust number.
Why this verdict
skippedThis report was generated before the per-signal breakdown was available. Rescan this address to see the full score log.
Display name, domain reputation, and authentication checks for the From address.
Display-name impersonation
NO BRAND CLAIMThe display name doesn't resemble any of the top phished brands we track — this isn't a brand-impersonation attempt.
Brand-lookalike radar
okNo typosquat or homoglyph match against the top 50 phished brands.
Domain age
okno RDAP record found
Signals extracted from the message body, embedded URLs, and uploaded screenshot.
Screenshot vision analysis
VISUAL · 90/100This email promotes a survey for a legitimate-sounding Dutch event (De Huishoudbeurs) via MarketResponse, but visible debug labels and lack of sender details are strong indicators of phishing or a poorly constructed fake. Avoid clicking the button.
- Debug labels visible (logoheader, bannerfooter, logofooter)
- No sender or header information
- Black 'Klik hier' button with no visible URL
- Overlaid annotations on images
- Suspicious image labels
MX records, deliverability probe, provider classification, and DNS blocklists.
Deliverability
ok- RFC 5322 syntax valid
- 1 MX record publishedmail.mailing.marketresponse.nl
- SMTP probe · unknown — SMTP probe disabled (set SMTP_PROBE_ENABLED=true to enable)
Provider classification
okNot on our disposable-provider list and not a recognised consumer freemail (Gmail / Outlook / Yahoo etc.) — likely a custom domain.
DNS blocklists
okListed by 1 of 3 blocklists:
Breach history for this address and the structural identity of the sending domain.
Breach exposure (HIBP)
okHIBP_API_KEY not configured
Sender infrastructure
