Safe to trust
The domain appears on one or more DNS blocklists used for spam filtering.
MalwareTips analyst · message material
generic_spamThis is spam advertising the direct sale of a research chemical stimulant called 3-FPO HCl.
- The message body and screenshot promote the sale of 3-FPO HCl, a piperidine-based CNS stimulant, priced at €19 for 0.25 g from a site labeled german lab.
- Sender domain katsulapharma.com has a URIBL listing and the email carries no authentication results beyond a soft-fail SPF.
- Screenshot analysis shows a product sales page rather than any email content, with visible red flags including torn layout and no headers.
- Subject is the single generic word hello with no context or legitimate business relationship indicated.
- No impersonation of any brand is present, but the unsolicited promotion of a gray-area research chemical constitutes clear spam behavior.
Do not click, reply, or purchase anything. Mark the message as spam and delete it.
Every scoring adjustment, in dominance order. Shows exactly how we got from 100 to the final trust number.
Why this verdict
100 → 79The scorer starts every address at 100 trust and applies each signal below in turn. Negative deltas are penalties (red), positive deltas are bonuses (emerald). Final clamped trust: 79.
- Listed on 1 DNSBL: URIBL.dnsbl_listed-15
- AI analyst flagged 85% spam likelihood.ai_spam_detected-13
- Domain has been registered for 4 years.domain_mature+10
- AI analyst flagged 10% phishing likelihood (generic_spam).ai_phishing_detected-5
- Domain publishes strong authentication policy: no DMARC published · SPF soft-fail.auth_dns_published+2
Display name, domain reputation, and authentication checks for the From address.
Display-name impersonation
NO BRAND CLAIMThe display name doesn't resemble any of the top phished brands we track — this isn't a brand-impersonation attempt.
Brand-lookalike radar
okNo typosquat or homoglyph match against the top 50 phished brands.
Domain age
ok- RegisteredApr 8, 2022mature (3-10 years)
- Age1519 days
- RegistrarNameCheap, Inc.
Signals extracted from the message body, embedded URLs, and uploaded screenshot.
Screenshot vision analysis
VISUAL · 0/100Screenshot is not an email; it shows a product page selling a research chemical (3-FPO HCl).
- torn/split image layout
- research chemical sales page
- no email headers visible
MX records, deliverability probe, provider classification, and DNS blocklists.
Deliverability
ok- RFC 5322 syntax valid
- 1 MX record publishedmail.katsulapharma.com
- SMTP probe · unknown — SMTP probe disabled (set SMTP_PROBE_ENABLED=true to enable)
Provider classification
okNot on our disposable-provider list and not a recognised consumer freemail (Gmail / Outlook / Yahoo etc.) — likely a custom domain.
DNS blocklists
okListed by 1 of 3 blocklists:
Breach history for this address and the structural identity of the sending domain.
Breach exposure (HIBP)
okHIBP_API_KEY not configured