Confirmed scam — delete it

This email uses government impersonation to promise a large sum of money in exchange for personal information.

Subject·not provided

Body-only scan — sender identity and infrastructure checks are unavailable.Re-scan with sender

At a glance

AI · 95% phishingAdvance Fee5 red flags1 body signal

Risk score

100

/ 100

malicious

AI analyst

MalwareTips analyst · message material

advance_fee

This email uses government impersonation to promise a large sum of money in exchange for personal information.

Phishing likelihood95%

Spam likelihood80%

Red flags identified

Uses a fraudulent government impersonation scheme promising a large, unrealistic sum of money.
Directs the recipient to contact an unofficial, suspicious email address for financial disbursement.
Employs high-pressure tactics by promising funds within a 48-hour window.
Requests sensitive personal information under the guise of a government restitution program.
Uses a non-governmental domain for official Treasury communication.

What to do

Do not reply to the email or provide any personal information. Delete the message immediately as it is a fraudulent attempt to steal your data or money.

Why this verdict

Every scoring adjustment, in dominance order. Shows exactly how we got from 100 to the final trust number.

Why this verdict

100 → 0

The scorer starts every address at 100 trust and applies each signal below in turn. Negative deltas are penalties (red), positive deltas are bonuses (emerald). Final clamped trust: 0.

The pasted address doesn't parse as a valid RFC-5322 email address.
syntax_invalid
-100

Body signals

Rule-based detectors for urgency language, credential theft phrasing, attachment bait and brand impersonation in text.

Phishing-pattern signals

1 signal

Rule-based pattern matches we ran across the message body and OCR text BEFORE the AI analyst. Each is a hint, not a verdict.

Uses urgency or time pressuremedium
“accessing your $14,700,000.00 within 48 hours as planned. Warm regards,”

Unlock more checks

Paste the sender to unlock identity + infrastructure analysis

This scan analysed the message body only. Adding the sender address, a Gmail Name <a@b.com> line, or full headers unlocks:

Display-name impersonation
Spot mismatched names like "PayPal Support" on a random Gmail.
SPF · DKIM · DMARC
See whether the sending server is authorised to use that domain.
Domain age + registrar
Brand-new domains are one of the strongest phish signals.
Breach exposure
How many known data breaches this specific address appears in.
MX + DNSBL reputation
Whether the domain can even receive mail and if it's on any blocklists.

Add sender and re-scan

Your previous paste won't be sent — you'll start a fresh scan with both fields.

Scan another

Check a different email address

URL instead?

Check if a link is safe

This report URL contains a SHA-256 hash, while the cached report retains normalized sender components, display name when available, and derived evidence. Raw .eml and screenshot bytes are discarded after extraction. The page is noindex, but anyone with the link may be able to view it; do not submit secrets or confidential messages. If you received this email and are worried, do not click any links and do not reply — verify the sender through a known-good channel.