PHISHANALYSER
A privacy-first educational tool for inspecting and learning to identify phishing emails. Runs entirely in your browser with zero network requests and an explainable, transparent scoring engine.
A privacy-first educational tool for inspecting and learning to identify phishing emails. Runs entirely in your browser with zero network requests and an explainable, transparent scoring engine.
All parsing and regex heuristics execute directly within your browser sandbox. Zero emails, headers, or metadata ever leave your client device.
Every warning sign adds mathematically defined point weights (0–100). Replaces black-box machine learning with transparent, auditable indicators.
Comprehensive detection vectors covering urgency triggers, credential requests, financial BEC fraud, IP URLs, weaponized macros, and authentication mismatches.
Dynamically classifies emails into Low Risk (0–29), Suspicious (30–59), and High Risk (60–100) with visual telemetry meters and category summaries.
Synthesizes tailored next-step security advice based on the exact threat vectors identified (e.g., verifying out-of-band, checking MX records).
Pre-loaded with 6 realistic training samples: obvious spam, sophisticated BEC, Microsoft 365 credential traps, package alerts, and verified legitimate mail.
| Attack Category | Heuristic Detection Pattern | Risk Weight |
|---|---|---|
| Urgency and panic-inducing language | +10 | |
| Immediate account closure or suspension threats | +15 | |
| Direct password or credential entry requests | +25 | |
| One-Time Password (OTP) or MFA code solicitations | +25 | |
| Wire transfer, gift card, or cryptocurrency demands | +30 | |
| Unsolicited bank account detail alteration notices | +25 | |
| Bare IP address URLs in hyperlinks | +20 | |
| URL shorteners (bit.ly, tinyurl, etc.) masking destinations | +15 | |
| Mismatched anchor text versus actual href destination | +20 | |
| Typosquatting and lookalike domain substitutions | +20 | |
| Executable attachments (.exe, .scr, .bat, .vbs) | +30 | |
| Failed SPF / DKIM / DMARC or Reply-To address mismatch | +20 |
Unlike online scanner APIs that store email contents on external servers, PhishAnalyser operates entirely in-memory:
Deconstructs Return-Path, Received hops, SPF/DKIM authentication outcomes, and Reply-To discrepancies.
Parses anchor tags, IP formats, suspicious TLDs, urgent call-to-actions, and credential solicitation triggers.
Aggregates transparent weights, displays risk stratification meters, and issues context-aware defenses.