Treat with caution
The domain appears on one or more DNS blocklists used for spam filtering.
MalwareTips analyst · message material
generic_spamThe email uses a vague, conversational tone from a personal Gmail account to initiate contact.
- Uses a generic free email provider for potentially unsolicited communication.
- Employs a vague, conversational hook designed to elicit a response from the recipient.
- Lacks any professional context or identifying information regarding the sender's identity.
Do not reply to the sender or provide any personal information. Delete the email as it is likely an attempt to initiate a social engineering conversation.
Every scoring adjustment, in dominance order. Shows exactly how we got from 100 to the final trust number.
Why this verdict
100 → 69The scorer starts every address at 100 trust and applies each signal below in turn. Negative deltas are penalties (red), positive deltas are bonuses (emerald). Final clamped trust: 69.
- Listed on 1 DNSBL: URIBL.dnsbl_listed-15
- AI analyst flagged 30% phishing likelihood (generic_spam).ai_phishing_detected-15
- AI analyst flagged 60% spam likelihood.ai_spam_detected-9
- Sender uses a well-known free-mail provider (gmail).free_provider+5
- Domain publishes strong authentication policy: DMARC p=none · SPF none.auth_dns_published+3
Display name, domain reputation, and authentication checks for the From address.
Display-name impersonation
NO BRAND CLAIMThe display name doesn't resemble any of the top phished brands we track — this isn't a brand-impersonation attempt.
Brand-lookalike radar
okNo typosquat or homoglyph match against the top 50 phished brands.
Domain age
okwell-known free provider — age check skipped
MX records, deliverability probe, provider classification, and DNS blocklists.
Deliverability
ok- RFC 5322 syntax valid
- 5 MX records publishedgmail-smtp-in.l.google.comalt1.gmail-smtp-in.l.google.comalt2.gmail-smtp-in.l.google.comalt3.gmail-smtp-in.l.google.com+1 more
- SMTP probe · unknown — SMTP probe disabled (set SMTP_PROBE_ENABLED=true to enable)
Provider classification
okHosted on the consumer freemail provider gmail. Not a red flag in itself — billions of legitimate users — but do verify identity through other channels for anything sensitive.
DNS blocklists
okListed by 1 of 3 blocklists:
Breach history for this address and the structural identity of the sending domain.
Breach exposure (HIBP)
okHIBP_API_KEY not configured