01 / CASE STUDY
Phishing email analysis
Explainable email triage without opening a link.
Open offline demo →I defined the project goals and reviewed the results. AI agents assisted with implementation and ran the automated tests.
Challenge
Give a learner or junior analyst a way to review suspicious email, see why it raises concern and choose a safe next step without visiting its links.
Environment
The application uses dependency-free HTML, CSS and JavaScript, with all analysis running locally in browser memory. Six fictional examples use reserved .example domains.
Built
The application uses weighted detection rules and a visible evidence breakdown. Combined limits on related indicators reduce double-counting: several signs of the same concern can only contribute a set maximum to the score. It checks urgency, requests for sensitive information, misleading links, attachment filenames and reported email-authentication results.
Tested
AI-executed automated tests cover score calculation, limits on related indicators, fictional examples and safe text rendering. Real-browser checks exercise the demo controls and layout at desktop and mobile widths.
Concepts
Rule-based detection makes the reasons for a score visible. Reported email-authentication results are evidence to review, not independently verified proof of who sent the message.
Outcomes
The obvious-phishing example scores 95; the legitimate-style notice scores 0. The parcel-fee example scores 19 despite describing a scam. These examples let a reviewer inspect both useful warnings and missed warning signs in the offline demo; they do not measure real-world detection accuracy.
Takeaways
The evidence breakdown makes each score inspectable. Comparing suspicious and legitimate-style examples shows why a low score still needs independent verification.
Limitations
The score summarizes weighted rule matches; it is not a probability that an email is malicious. Analysis is limited to pasted text, headers and attachment filenames. Plain text may omit a link’s actual destination, and pasted authentication headers can be forged or incomplete. Because the application reads text without visiting links or opening attachments, it cannot verify destinations, redirects, reputation or attachment contents. A low score therefore does not establish safety; findings require verification through a trusted channel.