sysop@hub:~/tools/phish-analyzer$

phish-analyzer

A user forwards you a mail and asks "is this real?". Drop the .eml file here, or paste the message source, and get a verdict with the reasons: who really sent it, whether authentication passed, where each link actually goes, and what the attachments are. The message is read by your browser and never uploaded, and nothing in it is opened, loaded or run.

Drop an .eml file here, or click to choose onethe raw message, with headers

getting the raw message

Client	How
Outlook (new) and Outlook on the web	Open the message, More actions (three dots), then Save as or Download. For the source only: View, View message source, and copy everything.
Outlook (classic)	It saves .msg, which this page cannot read. Ask the user to forward the mail as an attachment (Ctrl+Alt+F), then open that in Outlook on the web and download it as .eml.
Gmail	Open the message, three dots, Download message. Or Show original and copy everything.
Apple Mail / Thunderbird	File, Save As (raw message source), or drag the message into a folder.

what it looks at

Area	Checks
Authentication	SPF, DKIM and DMARC results recorded by the receiving server. A DMARC fail means the visible sender is forged.
Sender	A second address hidden in the display name, brand names used from unrelated domains, look-alike and punycode domains, replies redirected elsewhere.
Links	Text that shows one site and leads to another, bare IP addresses, shorteners, user info before an @, brand names on foreign domains, script and data links. Safe Links and similar wrappers are unwrapped first.
Attachments	Double extensions, HTML and SVG files, executable and macro types, archives, and whether the text mentions a password for them.
Body	Forms and password fields inside the mail, script, image-only messages (QR phishing), hidden filler text, pressure and credential wording.

This is a triage aid. A high score means several independent signs of phishing. A low score means none of these checks matched, which is not the same as safe: a mail sent from a colleague's genuinely compromised mailbox passes authentication, comes from the right domain and can score zero. The page does not visit links, open attachments or look anything up in reputation databases. Forwarded mail loses the original headers, so always work from the saved original.