EMAIL TRIAGE / EDUCATIONAL TOOL
Read the signals.
Not the promises.
Inspect suspicious email without visiting its links. Transparent rules, explainable evidence, no uploads.
01 / Inspect an email
All six examples use reserved .example domains. They are invented, not real messages.
02 / Evidence report
Awaiting input — no risk rating yet.
Always verify independently
- Do not click links or open attachments to test an email.
- Use a saved bookmark, known app, or separately obtained phone number. Do not use contact details from the suspect message.
- Confirm payment changes with a known contact through a second channel. Report suspicious messages to your security team.
- If you shared credentials: change them through the official service and contact your security team; review MFA and active sessions.
Method and limitations
The 0–100 score is a sum of unique weighted rules after family caps, not a probability or calibrated prediction. 0–19: low indicators; 20–49: suspicious; 50–100: high indicators. Low indicators does not mean safe.
Analysis covers only the text, headers and attachment filenames you provide. Plain text may omit actual link destinations. The tool does not resolve DNS, visit links, follow redirects, establish domain ownership, check reputation or scan attachment contents for malware. Brand-to-host matching is a heuristic that may flag legitimate third-party services. Pasted authentication headers can be forged: reported passes are unverified and never reduce the score, while missing results remain unassessable. Because rules can miss subtle scams or flag benign language, verify the message through an independent trusted channel.
The tool works locally without accounts, APIs, telemetry, uploads, external images or persistent storage. Reset clears this page’s inputs and report, but cannot erase your clipboard or browser-managed data.