Phishing triage
Someone reported an email. Paste its source or drop the .eml file to see the red flags in one place: sender, links, attachments and indicators.
Or drop an .eml file anywhere on this page (up to 10 MB). Read in your browser: nothing is sent unless you choose Check reputation.
What it checks
The sender: SPF, DKIM and DMARC results, replies going somewhere else, and the delivery path, as in the email header analyzer.
Links: every link in the text and HTML, with a red flag when the text shows one site but the link goes to another, or when it runs code (javascript:, data:) instead of opening a web page.
Attachments: name, type, size and SHA-256 hash, with a red flag for programs, scripts, shortcuts, disk images, web pages, Office files with macros, and files whose content doesn't match their name. Archives are called out too.
Share it, check it
Copy a ticket note with the subject, sender, authentication results, red flags, attachment hashes and every indicator, defanged so nothing is clickable. Press Check reputation to look the indicators up against URLhaus, ThreatFox, MalwareBazaar and Google Safe Browsing, and the verdicts go into the note too.
It never says a message is safe. If someone already clicked a link or opened an attachment, follow the phishing response checklist.
How to get the message
Gmail: More (⋮) → Download message saves an .eml file, or Show original lets you copy the source. Outlook on the web: ⋯ → View → View message source, or save the message as .eml. Apple Mail: File → Save As, format Raw Message Source. Classic Outlook's .msg files can't be read here. Files up to 10 MB; pastes up to 64 KB.
The message never leaves your browser
The message, its links and its attachments are read on your device. Nothing is opened, visited or loaded: the HTML is only parsed, so tracking images don't fire. Only the indicators you choose to check are sent, when you press Check reputation, and they aren't logged.