MalwareTips
Tier · dangerous
Verdict

Confirmed scam — delete it

This email uses deceptive branding and a suspicious link to lure recipients into a fake prize claim.

Subject·not provided
Body-only scan — sender identity and infrastructure checks are unavailable.Re-scan with sender
At a glance
AI · 95% phishingCredential Theft5 red flags
Risk score
100
/ 100
malicious
AI analyst

MalwareTips analyst · message material

credential_theft

This email uses deceptive branding and a suspicious link to lure recipients into a fake prize claim.

Phishing likelihood95%
Spam likelihood90%
Red flags identified
  • The sender address uses a random, non-Google domain despite claiming to be from Google.
  • The subject line uses emojis and high-pressure financial bait to encourage clicking.
  • The email contains a link to an unverified, non-HTTPS domain unrelated to the claimed brand.
  • Authentication checks (SPF, DKIM, DMARC) all failed or are missing, indicating a spoofed sender.
  • The message body is heavily obfuscated with large amounts of junk data to bypass spam filters.
What to do

Do not click the link or interact with the email. Mark it as junk and delete it immediately.

Why this verdict

Every scoring adjustment, in dominance order. Shows exactly how we got from 100 to the final trust number.

Why this verdict

100 → 0

The scorer starts every address at 100 trust and applies each signal below in turn. Negative deltas are penalties (red), positive deltas are bonuses (emerald). Final clamped trust: 0.

  • The pasted address doesn't parse as a valid RFC-[number] email address.
    syntax_invalid
    -100
URLs in message

Every link extracted from the body, ranked by risk. The highest-leverage signal when sender headers are missing.

Links extracted from this email

1 shown

Each link was scored against a host-level suspicion heuristic. Click Scan link to run our full URL scanner on the destination — it'll show our verdict alongside Google Safe Browsing, VirusTotal, URLhaus, and the others.

  • keepupwithwebseven.net
    /cl/31365_md/1009/10945275/1751/791/6a8482a472cb18067192bde3
    Link uses plain HTTP, not HTTPS
    Suspicion
    5
    Scan link
Unlock more checks

Paste the sender to unlock identity + infrastructure analysis

This scan analysed the message body only. Adding the sender address, a Gmail Name <a@b.com> line, or full headers unlocks:

  • Display-name impersonation
    Spot mismatched names like "PayPal Support" on a random Gmail.
  • SPF · DKIM · DMARC
    See whether the sending server is authorised to use that domain.
  • Domain age + registrar
    Brand-new domains are one of the strongest phish signals.
  • Breach exposure
    How many known data breaches this specific address appears in.
  • MX + DNSBL reputation
    Whether the domain can even receive mail and if it's on any blocklists.
Add sender and re-scan

Your previous paste won't be sent — you'll start a fresh scan with both fields.

Scan another
Check a different email address
URL instead?
Check if a link is safe
This report URL contains a SHA-256 hash, while the cached report retains normalized sender components, display name when available, and derived evidence. Raw .eml and screenshot bytes are discarded after extraction. The page is noindex, but anyone with the link may be able to view it; do not submit secrets or confidential messages. If you received this email and are worried, do not click any links and do not reply — verify the sender through a known-good channel.