Why sender-checking matters
Most phishing emails don't fail because the message content looks obviously fake — they fail because of mismatches an attacker can't easily hide: the *envelope sender* (the actual sending address) doesn't match the *claimed brand* (say, an email claiming to be from "PayPal Support" but sent from a random domain). This tool checks exactly that mismatch and surfaces it clearly.
What the tool evaluates
Domain match — whether the sending domain plausibly belongs to the claimed brand (e.g., `paypal.com` vs. a lookalike like `paypa1-support.net`).
Common spoofing patterns — character substitution (`0` for `o`), extra subdomains designed to look legitimate at a glance, and mismatched reply-to addresses.
Red flags and evidence — a clear breakdown of exactly which signals triggered concern, rather than just a pass/fail score, so you can make your own judgment.
Suggested next steps — practical guidance depending on the risk level (e.g., verify through the company's official site rather than any link in the email).
How to read the results
A "high risk" result doesn't guarantee the email is malicious, and a "low risk" result doesn't guarantee it's safe — this is a heuristic check based on visible signals, not a guarantee. Always combine it with common sense: legitimate companies rarely ask you to "verify your account" urgently via email link, and hovering over links (without clicking) to preview the real destination is one of the most reliable manual checks you can do yourself.
FAQ
Does this tool scan my actual inbox?
No — you manually enter the sender address and claimed brand for a specific email you're evaluating; nothing connects to your email account.
What should I do if a check comes back high-risk?
Don't click any links, download any files or reply. Instead, go directly to the company's official website or app (typed manually, not via the email) to check your account status.