Phishing Email Analyzer

Paste a suspicious email's headers and/or text (or its HTML source) to check sender authentication, spoofed senders, deceptive links and common phishing tactics. The analysis runs in your browser.

How the phishing email analyzer works

Phishing emails imitate trusted brands to trick you into clicking a link, opening an attachment, sending money or entering a password. Attackers change their wording constantly, but most phishing messages still leave technical and psychological fingerprints. This tool looks for those fingerprints in four places:

  • Authentication: the SPF, DKIM and DMARC results your mail provider recorded in the Authentication-Results header. A DMARC failure means the message is not provably from the domain in the From line.
  • Sender identity: mismatches between the display name, From address, Reply-To and Return-Path; brand names sent from free mailboxes; and lookalike domains such as paypa1.com or internationalised domains (xn--) that imitate real brands.
  • Links: link text that shows one address but points to another, raw IP addresses, URL shorteners, the @ trick, brand names buried in subdomains (paypal.com.account-check.example), unencrypted links and newly registered domains.
  • Content: urgency and threats ("within 24 hours", "account suspended"), requests for passwords or payment, gift cards and crypto, generic greetings and dangerous attachment types.

Each signal adds to a risk score. The score is a guide to how carefully you should treat the message, not a guarantee.

Privacy: the email is analysed by JavaScript in your browser and is never uploaded. Only if you click Check domain ages are the link domain names (not the email) sent to our server to look up their registration dates.

How to get the full email headers

  • Gmail: open the email → three-dot menu → Show original → Copy to clipboard.
  • Outlook.com / Microsoft 365: open the email → three-dot menu → View → View message source.
  • Apple Mail: View → Message → Raw Source.
  • Yahoo Mail: three-dot menu → View raw message.

Pasting the raw source gives the most complete analysis, because it includes the headers, the real link targets in the HTML and the authentication results. For a detailed hop-by-hop view use the email header analyzer.

What to do with a phishing email

  1. Don't click links, open attachments or reply.
  2. Report it: use your email provider's Report phishing button. You can also forward it to the impersonated company's abuse address and to your national reporting service (for example report@phishing.gov.uk in the UK or reportphishing@apwg.org).
  3. If you already clicked or entered details: change the password on the real site, turn on two-factor authentication, sign out other sessions, and contact your bank immediately if you shared payment details.
  4. Protect your own domain from being spoofed with SPF, DKIM and DMARC.

Frequently asked questions

Can this tool tell me an email is 100% safe?

No tool can. Skilled attackers send from compromised legitimate accounts that pass every technical check. Treat a low score as "no obvious red flags", and verify unexpected requests through another channel.

Why does a real email from my bank show some signals?

Legitimate marketing emails often use tracking links, link shorteners or third-party sending services, which resemble phishing techniques. Look at the overall picture, especially authentication results and link domains.

Does the analyzer open the links?

Never. Links are only parsed as text. To inspect a link safely, paste it into our redirect checker, which follows it from our server.

Copied to clipboard