Inspect the email.
Understand the warning signs.
Evidence-led triage for suspicious messages. Paste the source or import an .eml file to uncover risky links, identity mismatches, and social engineering.
01 / Message input
Optional identity context
Enter a domain you independently know belongs to the sender. Subdomains are accepted. This is a comparison, not an allowlist.
How to get better evidence
Use your mail client’s “Show original,” “View source,” or “Save as .eml” option. Forwarded or copied messages can lose headers and hidden link destinations.
What this detector can and cannot establish
This is an offline heuristic triage tool. Its 0–100 score measures triggered rules, not a probability. Low scores do not certify safety. It does not check live reputation, follow redirects, query DNS, verify DKIM signatures, scan attachment contents, or inspect images and QR codes.
SPF, DKIM, and DMARC values are unverified claims extracted from headers. Even a reported pass cannot prove the message is trustworthy. Confirm the trusted receiving gateway and original message with your mail administrator.
Supports common multipart MIME, base64 and quoted-printable text. Malformed, encrypted, signed, nested, or unusual messages may be only partially analyzed; inspect coverage notes.
02 / Triage overview
Awaiting inputReady for inspection
Heuristic concern score
Not a probability or safety certificate
Load a sample to see how the evidence translates into practical next steps.
03 / Evidence & reasoning
Findings appear here with their evidence, contribution, and recommended action.
04 / Technical inspection
Identity & authentication claims
No message analyzed.