Phishing Email Analyzer

Check a suspicious email against the tells that actually matter

Someone has forwarded you a message and asked whether it is real. You have perhaps two minutes, the message looks plausible, and the honest answer is that "it looks fine" is not a method. What you want is a checklist applied consistently — who really sent it, where the links really go, what the language is doing to you, and whether anything is attached that has no business arriving unsolicited.

Paste the full raw message here — headers and body together — and every one of those checks runs at once, in your browser, producing a risk score from 0 to 100, a verdict, and a list of the specific findings with the evidence that triggered each one. Nothing is uploaded. That is not a nicety: a suspicious email routinely contains the recipient's name, internal addresses, an invoice number and a live payload URL, and pasting it into a server-side scanner hands all of it to a third party. The analysis here happens in the tab; so does the optional plain-English explanation, which runs a local model in your browser and never sends the message anywhere.

How to get the raw message

The tool needs headers, not just the visible body. In Gmail, open the message and choose Show original, then copy the whole page. In Outlook desktop, File → Properties exposes the internet headers, or Save As → .eml and open the file in a text editor. In Apple Mail, View → Message → Raw Source. If you paste only the body, link and language checks still work but every sender check has nothing to read.

The checks, and what each one weighs

Every finding carries a severity, and severities carry fixed weights: critical adds 40 points, high 25, medium 12, low 5. The total is capped at 100. A score of 50 or above returns likely phishing, 20 to 49 returns suspicious, and below 20 returns probably safe. The scoring is deterministic — the same message always produces the same score.

Two worked examples

The built-in sample is a PayPal-themed credential phish. It scores 100 — likely phishing, on four high findings and two low ones (25 × 4 plus 5 × 2 is 110, capped at 100): the Reply-To domain (verify-account.info) does not match the From domain, the only link points at a raw IP address, nine separate urgency phrases appear across subject and body, the message asks the reader to confirm a password and a card number, the link path stacks login, secure and verify, and the greeting is "Dear Customer".

Worth noticing what the sample does not trigger: the display-name impersonation check stays silent, because the sending domain is paypal-secure-team.com and it contains the string "paypal". That check asks whether the brand named in the display name appears in the domain at all, so an attacker who registers a domain with the brand inside it defeats it. This is precisely why the score is built from many independent rules rather than one clever one.

A second example shows the critical findings firing. An invoice message with the display name "Microsoft 365" sent from a gmail.com address, whose visible link text reads https://login.microsoft.com/ while the href goes to micros0ft-billing.com, and which attaches invoice.exe, produces three critical findings — brand impersonation from a free mailbox, a link that lies about its destination, and an executable attachment — plus medium findings for the official-sounding subject from a consumer mailbox and the urgency phrasing. Score 100.

The link checks in detail

Links are pulled from HTML anchors first, capturing both the href and the visible text. If the message contains no anchors, plain-text URLs are collected instead, so a text-only email is still analysed — though with no visible text to compare against, the mismatch check cannot fire.

The mismatch test is the sharpest signal available in an email, and it is stricter than a plain string comparison. If the visible text itself looks like a domain, that domain is compared with the real hostname, and a subdomain relationship counts as a match — text reading example.com pointing at mail.example.com is not flagged. Only a genuinely different destination is.

Lookalike detection computes edit distance between the link's registrable name and each brand in the impersonation list, flagging anything one or two edits away. Domains like paypa1.com, rnicrosoft.com, app1e.com, arnazon.com and netflx.com are caught by this rule. Longer decorations — micros0ft-billing.com, paypal-secure-team.com — sit too far away in edit distance and are caught, if at all, by the mismatch or impersonation rules instead.

What this tool does not do — and where the limits bite

It does not evaluate SPF, DKIM or DMARC. Authentication results are a separate discipline with their own failure modes, and they live in our email header analyzer. This tool looks at the body and at the header relationships that matter for phishing: who the reply goes to, who the bounce goes to, what the display name claims. Running both on a genuinely uncertain message is the complete answer; running only this one leaves the question of whether the sending server was authorised unanswered.

It does not fetch anything. No link is resolved, no shortener is expanded, no domain is aged or checked against a reputation feed. Every judgement is made from the text you pasted. That is what keeps the analysis private, and it means a brand-new attacker domain with a clean-looking name will not be flagged for being new, because nothing here can know that it is.

It does not detect certainty in either direction. This is the point to be blunt about. A score is a weighted sum of pattern matches, not a verdict from a system that understands the message.

• A low score is not a clearance. The most expensive attacks — business email compromise, invoice fraud, a request from a compromised real account of a real supplier — contain no links, no attachments, no urgency clichés and no impersonated brand. They are plain sentences from a plausible address, and they score near zero here. If a message asks you to move money or change bank details, verify it out-of-band by phone regardless of what any tool says.
• A high score is not a conviction. Legitimate marketing uses shorteners and deadline language. A genuine password-reset email from a service you use contains reset your password and a path full of verify and account. Automated senders often have a Reply-To on a different domain than the From address for entirely mundane reasons. Read the individual findings, not just the number — each one shows the evidence that produced it.
• Attachment detection reads filenames, not files. The check finds a filename= parameter in the raw source and looks at the extension. It cannot inspect content, so a renamed executable, a double extension, or a malicious PDF will not be flagged by type alone.
• The brand and phrase lists are finite. Impersonation and urgency checks match against curated lists of commonly abused brands and phrases. An attack impersonating your specific supplier, your bank if it is a regional one, or writing in a language other than English will not match them.

The optional local explanation

Below the findings there is an optional AI panel that turns the flag list into three to five plain sentences for a non-technical recipient — useful when you need to explain to the person who forwarded the message why it is a problem and what to do next. It runs a model in your browser, so the email still never leaves the machine, and it is explicitly downstream of the rules: it receives the findings that already fired and is instructed not to invent new ones. It cannot change the score. If it is unavailable or you skip it, the analysis is complete without it.

What to do with the result

If the verdict is likely phishing: do not click, do not reply, and do not forward it as an attachment to colleagues who might click. Report it through whatever channel your organisation uses, and if anyone has already interacted with it, treat credential reset and session revocation as the first action rather than the last. If the message impersonated a real supplier or customer, tell them — their domain is being used and they will want to know.

If the verdict is suspicious, read the individual findings. Two medium flags on a newsletter is noise; a Reply-To mismatch plus a shortened link on a message about an invoice is a phone call to the sender on a number you already had.

If the verdict is probably safe and something still feels wrong, trust the feeling. The tool checked the things it knows how to check, and the list of things it cannot check — who really controls that domain, whether this request is plausible from this person, whether the account was taken over last week — is exactly the list a human is better at.