phishing email analyzer

Know if an email is phishing without clicking anything.

phishing email analyzer gives your AI agent a SOC-style triage script for suspicious email. Hand it a saved .eml file or the raw headers you copied out of Gmail or Outlook. It reads the evidence the receiving mail server recorded, checks every link, sender address and attachment against tested rules, and returns a 0-100 risk score that lists each reason with its points. You also get a plain-English "Is this safe?" answer for the person who received the email, plus a defanged IOC file for whoever blocks it. Everything runs locally. Links are never opened and attachments are never saved or run.

What it does

• Authentication: reads SPF, DKIM and DMARC results from Authentication-Results (RFC 8601), Received-SPF and Microsoft's compauth, checks each one's alignment with the From domain, and reports the sender's DMARC policy. It uses only the top (your provider's) Authentication-Results header, because lower ones can be forged.
• Route forensics: reads the Received chain oldest-first and reports each hop's IP class (private, CGNAT, documentation, public), the origin IP, hop delays, and negative time jumps that point to a forged or skewed line.
• Sender checks: compares From, Reply-To and Return-Path, catches display-name spoofing ("PayPal Service" sending from some other domain), freemail senders using brand lures, and Microsoft's own phishing/spoof verdicts (X-Forefront-Antispam-Report CAT codes).
• Look-alike domains: punycode (xn--), mixed Cyrillic/Greek/Latin letters, homoglyphs based on Unicode TR39 confusables (1,586 mappings bundled), 1-2 letter typos, brand-secure.com and paypal.com.evil.net patterns. Covers 30 common brands, and you can add your own brands and your company's domain to catch CEO and vendor fraud (BEC).
• Links: pulls URLs from text, HTML anchors, forms, iframes and meta refresh. Flags link text that shows one domain but points to another, bare IPs, odd ports, URL shorteners and http logins. Unwraps Microsoft Safe Links so you see the real target.
• Attachments: hashes each file in memory (MD5, SHA-1, SHA-256), detects the real file type from its bytes, flags double extensions, HTML/SVG login pages, password fields, forms that post elsewhere, macro-enabled Office files, encrypted archives, and file types on Outlook's and Gmail's block lists. Zips are listed but never extracted.
• Outputs: a terminal report, triage.md, iocs.csv (all defanged and safe from CSV formula injection), answer.txt in plain language, and triage.json.

Problems it solves

• "Is this email real?" questions from family, staff or clients, answered with evidence instead of a gut feeling
• CEO gift-card and fake-vendor emails that pass SPF, DKIM and DMARC because the attacker owns a look-alike domain
• Raw headers too long and confusing to read by hand
• Pasting a suspicious link into a browser or scanner "just to check"
• Rebuilding IOC lists by hand for a blocklist, ticket or abuse report

Who it's for

Small-business owners and office managers, MSPs and IT generalists, help-desk and SOC analysts who want a fast first pass, and anyone who gets asked "is this a scam?". The plain-English answer works for non-technical people, and the scored report and IOCs work for analysts.

What's included

• SKILL.md: safety rules for the agent, how to capture headers in Gmail and Outlook, run commands, how to read each signal, and the order to deliver results
• scripts/phish_triage.py (main CLI), eml_parse.py, indicators.py, make_samples.py (4 harmless test emails using reserved .test domains and RFC 5737 IPs)
• scripts/data/: Unicode confusables subset, brand domain list, and blocked/risky file-type lists with their sources
• references/: every standard and provider rule with its official source (RFCs, Microsoft, Google, FTC, CISA, Unicode), the full scoring table, and a header-forensics guide
• examples/expected-results.md

Standard-library Python only. No API keys, no network calls, no installs.