About the phishing detector
What it checks
- Links: where they lead, whether they imitate a well-known brand and whether they are shortened or send you on to another site.
- Text: pressure phrases, requests for passwords or payments and steps to run something on the computer.
- Sender: whether the name and the address match and whether the address imitates a brand.
- Technical data of the email: whether the email passed the authenticity checks and whether the times of its journey add up.
- File: its name, its real type, its digital fingerprint (SHA-256) and, in compressed files, Office documents, PDFs, RTF files, web pages and SVG images, what they carry inside: programs, macros, scripts, objects and external addresses.
What it does not do
- It does not open any link.
- It does not open or run the file.
- It does not give a verdict: it shows signals and explains them.
- It does not store or send the message or the file.
How it handles the message
- The text of the message is shown as text. It is never run.
- Links are shown with the address altered, such as hxxps://site[.]com, so that they cannot be clicked by mistake.
- The analysis has a limit of size and of time, so that a huge message cannot freeze your browser.
- The page only allows its own programs and those of the visit statistics.
Limits
- The lists of brands, endings and phrases are estimates and can fail.
- A legitimate message can trigger pressure signals.
- If the message does not carry the real address of the links, the analysis only sees the visible text.
- The authenticity checks of the email only count if your own mail server added them.
- No signals does not mean safe.
Phishing detectorPrivacy and cookies