Failed authentication (SPF=none, DKIM=fail, DMARC=fail), no sender history, and suspicious "member profile modified" notification—classic phishing pattern to trick users into clicking or verifying credentials. · score 87

Suspicious sender (res-marriott.com is not Marriott's official domain), empty body with only invisible characters (common phishing tactic), and no legitimate reservation context provided. · score 74

Forwarded email with deceptive subject line ("account deletion reminder") that conflicts with promotional content about an AI platform trial expiring; misleading urgency tactic combined with unknown service. · score 62

Unsolicited Zoom meeting from unknown sender with no history; Microsoft warning about unusual sender; obfuscated links via Outlook safelinks proxy are common phishing tactics. · score 62

Impersonation of Microsoft Bing Webmaster Tools with credential-harvesting verification link; claims account loss to pressure action. · score 74

Forwarded email impersonating Microsoft Defender; sender authentication fails (SPF=?, DKIM/DMARC=none), no sender history, and fabricated content (CVE IDs don't match real vulnerabilities in this form) designed to trigger urgency around security alerts. · score 74

Forwarded contact form about disputed charge; sender domain (piawest.com) matches recipient but inner email spoofs legitimate company (prismams.com); third-party inquiry about another person's charge is a common fraud pattern to appear legitimate while harvesting account/payment information. · score 68

Authentication failures (SPF/DKIM/DMARC), no sender history, and profile modification notification are classic phishing red flags—likely credential harvesting or impersonation of a professional organization. · score 93

Failed authentication (SPF=none, DKIM=fail, DMARC=fail), no sender history, and suspicious profile modification notification with credential change (email address) — classic phishing pattern mimicking legitimate admin alerts. · score 99

Impersonates TransUnion with deceptive "approval odds" offer; suspicious sender domain (updates.transunion.com, not official), suspicious encoded click-tracking link, and vague body designed to prompt credential entry or personal data sharing. · score 68

Domain mismatch (statefarmservice.com vs official State Farm domain) combined with billing urgency and generic greeting create phishing red flags despite passing authentication checks. · score 60

Multiple authentication failures (SPF=none, DKIM=fail, DMARC=fail), no strong sender history, suspicious "You don't often get email from this sender" warning, and request for registration details—classic phishing indicators. · score 87

Impersonates Microsoft security alert to trick user into reviewing quarantined messages; spoofed sender domain and urgency tactics are classic phishing markers. · score 74