Likely scam — do not engage
Our AI analyst read the message body and judged it likely to be phishing.
MalwareTips analyst · message material
credential_theftSuspicious request for quotation using a generic greeting and a vague reference to an unseen attachment.
- The message uses a generic 'Dear Sir/Madam' salutation which is inconsistent with a professional business request from a specific director.
- The sender's domain is listed on a DNS blocklist (URIBL), indicating it has been associated with suspicious activity.
- The email contains a vague request to open an attachment for details, a common tactic for delivering malware or credential-harvesting documents.
- An external sender warning banner is present, suggesting the sender is not a regular contact or the address may be spoofed.
- The message body contains repetitive text and lacks specific details about the items or services being requested.
Do not open any attachments or click links in this email. Verify the request through a known, trusted contact channel for Marshall Electronics before taking further action.
Every scoring adjustment, in dominance order. Shows exactly how we got from 100 to the final trust number.
Why this verdict
100 → 43The scorer starts every address at 100 trust and applies each signal below in turn. Negative deltas are penalties (red), positive deltas are bonuses (emerald). Final clamped trust: 43.
- AI analyst flagged 85% phishing likelihood (credential_theft).ai_phishing_detected-43
- Screenshot OCR + visual pass flagged 65/100 phishing risk: The email uses a generic 'Dear Sir/Madam' greeting and a vague request to open an attachment for details, which are common tactics for malware delivery. An external sender warning banner is present, indicating the sender's address may be spoofed or is not a frequent contact.screenshot_phishing_visual-20
- Listed on 1 DNSBL: URIBL.dnsbl_listed-15
- Domain has been registered for over 23 years.domain_longstanding+15
- Domain publishes strong authentication policy: DMARC p=reject · SPF hard-fail.dmarc_reject_enforced+15
Display name, domain reputation, and authentication checks for the From address.
Display-name impersonation
NO BRAND CLAIMThe display name doesn't resemble any of the top phished brands we track — this isn't a brand-impersonation attempt.
Brand-lookalike radar
okNo typosquat or homoglyph match against the top 50 phished brands.
Domain age
ok- RegisteredFeb 19, 2003long-established (10+ years)
- Age8533 days
- RegistrarGoDaddy.com, LLC
Signals extracted from the message body, embedded URLs, and uploaded screenshot.
Phishing-pattern signals
1 signalRule-based pattern matches we ran across the message body and OCR text BEFORE the AI analyst. Each is a hint, not a verdict.
- Uses a generic, impersonal greetinglow“Dear Sir/Madam, Kindly provide your qu”
Links extracted from this email
1 shownEach link was scored against a host-level suspicion heuristic. Click Scan link to run our full URL scanner on the destination — it'll show our verdict alongside Google Safe Browsing, VirusTotal, URLhaus, and the others.
- www.marshall-usa.comLink uses plain HTTP, not HTTPSSuspicion5
Screenshot vision analysis
VISUAL · 65/100The email uses a generic 'Dear Sir/Madam' greeting and a vague request to open an attachment for details, which are common tactics for malware delivery. An external sender warning banner is present, indicating the sender's address may be spoofed or is not a frequent contact.
- External sender warning banner
- Generic salutation
- Vague request for quotation
- Reference to unseen attachment
- http://www.marshall-usa.com/
MX records, deliverability probe, provider classification, and DNS blocklists.
Deliverability
ok- RFC 5322 syntax valid
- 1 MX record publishedmarshallusa-com02b.mail.protection.outlook.com
- SMTP probe · unknown — SMTP probe disabled (set SMTP_PROBE_ENABLED=true to enable)
Provider classification
okNot on our disposable-provider list and not a recognised consumer freemail (Gmail / Outlook / Yahoo etc.) — likely a custom domain.
DNS blocklists
okListed by 1 of 3 blocklists:
Breach history for this address and the structural identity of the sending domain.
Breach exposure (HIBP)
okHIBP_API_KEY not configured