loading_
Got an email that feels off? Paste its content below. Our AI analyst will check it for common red flags associated with phishing and scams.
Include headers for a more accurate analysis. This tool is for educational purposes only.
Paste a suspicious email and it explains what is wrong with it: the sender domain, the links, the pressure tactics and the specific phrases doing the manipulation, each quoted back with the reason it is a red flag.
It is written to teach rather than just to judge, so the person who pastes an email learns what to look for next time instead of simply being told a score.
Report it, do not just delete it
Deleting protects you. Reporting protects everyone else, and gives whoever runs your email security the chance to find the rest of the campaign. A single fast report is worth more than a hundred quiet deletions.
If anyone acted on it, treat that as an incident
Entering credentials or approving a multi-factor prompt matters far more than clicking a link. Change the password, revoke sessions, and check for mail rules the attacker may have created.
Check whether your own domain can be spoofed
If the email impersonated your organisation, the underlying problem may be your DNS rather than your people. Attackers can only spoof your exact domain if you have not published a DMARC reject policy.
Notice the pattern, not just the message
Almost every social engineering attempt combines urgency, authority and isolation. Teaching people that pattern survives changes in the technology, where teaching them to spot bad spelling does not.
It reads text. It cannot open attachments, follow links, inspect email headers or tell you whether a link leads to a malicious site, and it can be wrong in both directions. A clean result is not permission to trust a message, and a suspicious result is not proof of an attack. Verify unusual requests through a channel the sender did not choose.
The reliable test is no longer how the message looks. Generative AI has removed the poor spelling and awkward phrasing that awareness training taught people to spot. What still works is the pattern: urgency, apparent authority and pressure not to check with anyone else. Any request combining those deserves verification through a channel the sender did not choose.
The text is sent to our AI provider for analysis and the result is shown in your browser. We do not store it. Do not paste anything containing personal data, credentials or confidential information, and remember that the analysis covers text only: attachments and links are not opened or inspected.
Clicking a link is usually less serious than what follows. If you entered credentials or approved a multi-factor prompt, change that password immediately, revoke active sessions, and check for forwarding rules or mailbox rules you did not create, which attackers commonly add to stay hidden. Then tell whoever runs your IT, promptly and without embarrassment.
Because they exploit attention and workload rather than knowledge. Phishing was experienced by 38% of UK businesses last year and rated the most disruptive attack by 69% of those breached. Under time pressure, with a plausible story and an authority figure applying urgency, people act on instinct. That is a system problem, not a competence one.