Question 1

What is phishing and why is it dangerous?

Accepted Answer

Phishing is a cyberattack where attackers impersonate legitimate entities to steal sensitive information such as passwords, credit card numbers, banking details, or personal data. It is typically carried out through fraudulent emails that appear to come from trusted sources like banks, government agencies, or well-known companies. Phishing is dangerous because it exploits human trust rather than technical vulnerabilities, making it one of the most successful attack vectors. According to recent studies, phishing accounts for over 90% of successful cyberattacks and costs billions annually in damages.

Question 2

How does Phishing Inspector's multi-layered analysis work?

Accepted Answer

Phishing Inspector uses a sophisticated multi-layered approach that analyzes emails through multiple independent security layers. First, 2 independent AI models (Llama 3.1 8B and Gemma 2 2B) run in parallel to categorize emails as PHISHING, SPAM, LEGITIMATE, or COMMERCIAL. Second, all URLs are verified in real-time against threat intelligence databases including Google Safe Browsing, VirusTotal (scanning with 70+ antivirus engines), URLhaus (malware URL database), and URLScan.io. Third, IP addresses are checked against AbuseIPDB and DNS blacklists (DNSBL). Fourth, email authentication protocols (SPF, DKIM, DMARC) are validated. Fifth, behavioral patterns and social engineering tactics are analyzed. Finally, all results are combined using a weighted ensemble algorithm to calculate risk scores across five dimensions: Content Risk, URL Risk, Header Risk, Attachment Risk, and Behavioral Risk.

Question 3

What is Google Safe Browsing and how do you use it?

Accepted Answer

Google Safe Browsing is a service provided by Google that identifies unsafe websites and protects billions of users worldwide. It maintains a constantly updated database of malicious URLs associated with phishing, malware, and unwanted software. Phishing Inspector queries the Google Safe Browsing API to verify every URL found in emails, providing real-time threat detection. When Google Safe Browsing identifies a threat, it significantly increases the risk score and the finding is clearly marked as "Externally Verified" in reports. This provides an additional layer of confidence beyond AI-based detection. Learn more at developers.google.com/safe-browsing.

Question 4

What is VirusTotal and how does it enhance detection?

Accepted Answer

VirusTotal is a security platform owned by Google that aggregates over 70 antivirus engines and URL/domain reputation services. When you submit an email for analysis, we send all extracted URLs to VirusTotal, which scans them against its extensive database and antivirus engines. If 3 or more engines flag a URL as malicious, we consider it a confirmed threat. This multi-engine approach significantly reduces false positives while catching threats that might evade individual security vendors. VirusTotal results are displayed in the SOC analyst report showing exactly how many engines detected threats. Learn more at virustotal.com.

Question 5

What are URLhaus and URLScan.io?

Accepted Answer

URLhaus is a project by abuse.ch that maintains a database of malicious URLs used for malware distribution. It is community-driven and focuses specifically on malware hosting sites, making it highly effective for detecting malware download links in phishing emails. URLScan.io is a comprehensive URL analysis platform that provides detailed scans of websites, including screenshots, network requests, and threat intelligence. It maintains historical data and verdicts on millions of URLs. Together, these services provide specialized coverage that complements general-purpose tools like Google Safe Browsing and VirusTotal. Learn more at urlhaus.abuse.ch and urlscan.io.

Question 6

What is AbuseIPDB and DNS blacklist checking?

Accepted Answer

AbuseIPDB is a project dedicated to tracking and reporting malicious IP addresses. When an email is received, we extract IP addresses from email headers (showing the path the email took) and check them against AbuseIPDB's database, which contains reports from thousands of network administrators worldwide. An abuse confidence score is calculated based on the number and severity of reports. We also check IPs against DNS-based blacklists (DNSBLs) including Spamhaus, SpamCop, and Barracuda, which maintain lists of known spam and malware sources. Together, these checks help identify emails originating from compromised or malicious infrastructure. Learn more at abuseipdb.com.

Question 7

What are SPF, DKIM, and DMARC email authentication?

Accepted Answer

SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication) are email authentication protocols that help verify email legitimacy. SPF allows domain owners to specify which mail servers can send emails on their behalf, preventing sender address forgery. DKIM adds a digital signature to emails, ensuring they haven't been tampered with in transit. DMARC builds on both, specifying how receiving servers should handle authentication failures and providing reporting. Our analysis checks these authentication results in email headers. Failed authentication is a strong phishing indicator, while passing authentication (especially from reputable domains) reduces risk scores. However, authentication alone isn't conclusive as attackers can compromise legitimate accounts or use authenticated domains for phishing.

Question 8

What is the MITRE ATT&CK framework and how is it used?

Accepted Answer

MITRE ATT&CK is a globally recognized knowledge base of adversary tactics and techniques based on real-world observations. It provides a common language for describing cyberattacks. Phishing Inspector maps detected indicators and behaviors to specific MITRE ATT&CK techniques, such as T1566.002 (Phishing: Spearphishing Link) or T1566.001 (Phishing: Spearphishing Attachment). This mapping is displayed in the SOC analyst report, helping security professionals understand the attack methodology, assess potential impact, and implement appropriate defenses. It also aids in threat hunting and incident response by providing context about attacker behaviors. Learn more at attack.mitre.org.

Question 9

How are risk scores and confidence levels calculated?

Accepted Answer

Risk scores are calculated using a weighted ensemble approach across five dimensions: Content Risk (based on AI model categorization and linguistic analysis), URL Risk (based on external verification from Google Safe Browsing, VirusTotal, URLhaus, URLScan.io), Header Risk (based on authentication failures, IP reputation from AbuseIPDB and DNSBL), Attachment Risk (based on file types and characteristics), and Behavioral Risk (based on social engineering tactics and manipulation patterns). Each dimension is scored 0-100, then weighted and combined into an overall risk score. The 2 AI models primarily suggest categorization (PHISHING, SPAM, LEGITIMATE, COMMERCIAL), while external verification services, authentication checks, and behavioral analysis provide additional evidence that can confirm or override AI suggestions. Confidence levels represent certainty about the verdict, adjusted based on: external verification results (higher confidence when threats are confirmed), authentication status (passing SPF/DKIM increases confidence in legitimate verdicts), consensus among AI models (both agreeing increases confidence), and mixed signals between layers (reduces confidence).

Question 10

What do the different verdict levels mean?

Accepted Answer

PHISHING: High confidence that the email is a phishing attempt designed to steal credentials or information. Immediate action required: do not click links, do not reply, report to IT security. SPAM: The email is unsolicited bulk mail, potentially containing misleading offers or low-risk scams. Generally safe to delete without concern. SUSPICIOUS: The email shows concerning indicators but lacks definitive proof of malicious intent. Exercise caution, verify sender through alternative channels before taking action. LEGITIMATE: The email appears genuine based on all analysis layers. However, always use common sense and verify unexpected requests through official channels.

Question 11

Is the detection 100% accurate?

Accepted Answer

No detection system is perfect, including ours. While our multi-layered approach combining 2 independent AI models (Llama 3.1 8B and Gemma 2 2B), threat intelligence from industry-leading services (Google Safe Browsing, VirusTotal, URLhaus, URLScan.io), email authentication validation (SPF, DKIM, DMARC), IP reputation checks (AbuseIPDB, DNSBL), and behavioral analysis provides highly accurate results, sophisticated attackers continuously evolve their techniques. Our system is designed to minimize false positives (legitimate emails marked as phishing) while catching the vast majority of threats. The AI models suggest categorization, which is then validated or overridden by external verification results. The confidence score helps you understand how certain the system is about its assessment. Always use your judgment and verify suspicious requests through alternative channels, even if an email is marked as legitimate. For critical decisions, we recommend reviewing the detailed SOC analyst report which shows exactly why a verdict was reached.

Question 12

What is email source and why must I provide it?

Accepted Answer

Email source (also called "raw email" or "original message") is the complete email including all technical headers like Received, DKIM-Signature, SPF, Return-Path, and authentication results. These headers contain crucial information for accurate threat detection: the actual path the email took through mail servers (showing origin), email authentication results (SPF, DKIM, DMARC), sending server IP addresses (checked against blacklists), technical indicators of spoofing or forgery. Screenshots, forwarded emails, or body text alone lack this critical data, potentially resulting in inaccurate analysis. Complete email source allows our system to perform comprehensive header analysis and authentication verification, significantly improving detection accuracy.

Question 13

How do I get the email source in Gmail?

Accepted Answer

In Gmail: (1) Open the email you want to analyze, (2) Click the three dots menu (⋮) in the top right corner of the email, (3) Select "Show original" from the dropdown menu, (4) A new tab will open showing the complete email source, (5) Click "Copy to clipboard" or select all text (Ctrl+A or Cmd+A) and copy, (6) Paste the complete source into Phishing Inspector. The source will start with headers like "Delivered-To:", "Received:", "Authentication-Results:", "DKIM-Signature:", etc. Make sure to copy everything, including all headers and the message body.

Question 14

How do I get the email source in Outlook?

Accepted Answer

In Outlook Desktop: (1) Open the email, (2) Go to File > Properties (or right-click the email and select Properties), (3) Look for the "Internet headers" section at the bottom and copy all content. In Outlook Web App: (1) Open the email, (2) Click the three dots menu (...) at the top, (3) Select "View" > "View message source" or "View message details", (4) Copy all the text displayed. In newer Outlook versions: Right-click the email in your inbox and select "View Source". The source includes headers starting with "Received:", "From:", "To:", followed by authentication results and the message body.

Question 15

How do I get the email source in other email clients?

Accepted Answer

Most email clients have an option to view raw source: Apple Mail: View > Message > Raw Source (or press Option+Cmd+U). Thunderbird: View > Message Source (or press Ctrl+U on Windows, Cmd+U on Mac). Yahoo Mail: Click "More" (...) > "View Raw Message". ProtonMail: Click the three dots > "View source" or "View headers". Mobile devices: Email source is typically not easily accessible on mobile apps. See the next question for mobile-specific instructions. The option is usually in a menu accessed by right-clicking the email, three-dot menu, or under View/Message options. Look for terms like "View Source", "Show Original", "Message Source", "Raw Message", or "Internet Headers".

Question 16

Can I analyze emails from mobile devices (iPhone, Android)?

Accepted Answer

Yes. The system now supports analysis with or without email headers. While desktop email clients make it easiest to access complete email source with headers (Gmail "Show original", Outlook "View Source"), mobile devices can still be used effectively. TO EXTRACT EMAIL CONTENT FROM MOBILE: Method 1 - Forward the email (RECOMMENDED): Open the suspicious email, forward it to yourself or another account, open the forwarded email on desktop and extract full source with headers. This preserves most technical information. Method 2 - Select and copy visible content: Open the suspicious email, use your device's select-all feature (long press and drag, or tap "Select All"), copy everything including sender, subject, and body, paste into Phishing Inspector. The system automatically detects whether headers are present and adjusts analysis accordingly. WITH HEADERS: Full analysis including email authentication (SPF, DKIM, DMARC), IP reputation checks, routing verification, and higher confidence scores. WITHOUT HEADERS: Limited but still valuable analysis including AI-based content analysis from 2 models (Llama 3.1 8B and Gemma 2 2B), full URL verification (Google Safe Browsing, VirusTotal, URLhaus, URLScan.io), domain age checking, and behavioral pattern detection. TIP: For best mobile experience, forward the email to yourself and analyze it from a desktop computer when convenient.

Question 17

What should I include when copying email body from mobile?

Accepted Answer

When copying email content from a mobile device for Body-Only Mode analysis, include as much information as possible: ESSENTIAL (always include): The complete email body with all text, All visible URLs (links), The sender's email address or name. HELPFUL (include if visible): Subject line, Recipient information (To: field), Date sent, Any quoted or forwarded text. HOW TO IMPROVE ACCURACY: Copy text like "From: suspicious@domain.com" at the top, Include "Subject: Account Verification Required" if you can see it, Copy everything - don't edit or shorten the content, Include signature blocks and footer text. MINIMUM REQUIREMENTS: At least 100 characters of email content, At least 5 meaningful words (not just "Click here now verify"), Content that appears email-related (not random text). The more complete your copy, the better the analysis. The system will extract sender, subject, and other metadata from formatted text if you include it.

Question 18

What analysis methods does Phishing Inspector support?

Accepted Answer

You can analyze emails in three ways: (1) Paste complete email source with headers (RECOMMENDED - Desktop): Provides the most accurate analysis including header authentication, IP reputation, routing analysis, and full content analysis. Copy from: Gmail "Show original", Outlook "View Source", etc. (2) Upload .eml file (Desktop): EML files contain complete email data including all headers, making them equivalent to pasting source. Export from your email client and upload. (3) Paste email body only (Mobile/Limited): If you cannot access headers (mobile devices), paste the email body with sender and subject information. The system automatically detects "Body-Only Mode" and performs limited analysis: AI content analysis, URL verification, behavioral detection. Note: Body-only analysis has lower confidence and cannot perform header-based checks. For complete analysis, use methods 1 or 2 from a desktop computer.

Question 19

Is my data stored or logged?

Accepted Answer

No. Phishing Inspector does not store, log, or share any content you submit. All analysis is performed in real-time in memory and data is permanently discarded immediately after your report is generated. We do not save emails, URLs, IP addresses, analysis results, or any other information. We do not track which emails are submitted or create user profiles. The only data sent externally is to the threat intelligence APIs (Google Safe Browsing, VirusTotal, URLhaus, URLScan.io, AbuseIPDB) for verification, and these services only receive URLs and IP addresses without any context about the email. Your privacy and security are our highest priorities.

Question 20

What is the difference between the Simple and SOC Analyst reports?

Accepted Answer

Simple Report (Normal User View): Designed for everyday users without security expertise. Shows clear verdict (Phishing, Spam, Legitimate) with easy-to-understand explanations, risk score, top warning signs, and actionable recommendations. Focuses on what you need to know and what actions to take. SOC Analyst Report (Technical View): Designed for security professionals and SOC analysts. Includes everything in the simple report plus: detailed risk breakdown across five dimensions with radar chart visualization, complete IOC (Indicators of Compromise) extraction with all URLs, IPs, domains, email addresses, and suspicious keywords, comprehensive external verification results from all threat intelligence sources, results from both AI models showing their categorization and consensus level, MITRE ATT&CK technique mappings, complete header analysis with email authentication results and routing path, attachment analysis with file hashes, and detailed findings with evidence and impact assessment. You can switch between views at any time.

Question 21

What AI models does Phishing Inspector use?

Accepted Answer

Phishing Inspector uses 2 large language models that run in parallel for email categorization: (1) Llama 3.1 8B Instruct (meta-llama/Llama-3.1-8B-Instruct): Powerful general-purpose model with 128K token context, excellent for understanding complex email content and social engineering tactics. (2) Gemma 2 2B IT (google/gemma-2-2b-it): Fast, lightweight model with 8K token context for quick categorization. Both models analyze emails independently and contribute equally to the consensus algorithm. Their primary role is categorization (PHISHING, SPAM, LEGITIMATE, COMMERCIAL), while final risk scoring combines their output with external verification from Google Safe Browsing, VirusTotal, URLhaus, URLScan.io, AbuseIPDB, DNSBL, email authentication validation, and behavioral analysis. When both models agree (100% consensus), confidence is highest. When they disagree (50% consensus), additional scrutiny is applied. The SOC analyst report shows results from both models including their categorization and confidence levels.

Question 22

How long does analysis take?

Accepted Answer

Most analyses complete in 15-30 seconds. The time varies based on: email complexity (length, number of URLs and attachments), external API response times (Google Safe Browsing, VirusTotal, etc.), and number of URLs to verify (each URL is checked against multiple services). The progress indicator shows which stage is currently running (Parsing, AI Analysis, URL Verification, etc.). During peak usage, external APIs may have rate limits which could slow analysis, but the system continues to work through all layers. All analysis happens in real-time with no queuing.

Question 23

Can I use this for my organization or security team?

Accepted Answer

Yes. Phishing Inspector is free for both personal and professional use. Security teams often use it for: initial triage of suspicious emails reported by employees, training exercises to demonstrate how phishing emails are detected, supplementing existing email security solutions with additional verification layers, and research and analysis of phishing campaigns. The SOC analyst report is specifically designed for security professionals with detailed technical data, IOC extraction, and MITRE ATT&CK mappings. However, for high-volume organizational use, we recommend implementing dedicated enterprise email security solutions with automated processing and centralized management.

Question 24

What should I do if I receive a phishing email?

Accepted Answer

If Phishing Inspector identifies an email as phishing: (1) Do not click any links or download attachments, (2) Do not reply or provide any information, (3) Do not forward the email to others (except to your IT security team), (4) Report it: In corporate environments, report to your IT security team immediately. In personal email accounts, use the "Report Phishing" or "Report Spam" button in your email client. Consider reporting to authorities: reportphishing@apwg.org (Anti-Phishing Working Group), spam@uce.gov (FTC), the FBI IC3 (ic3.gov) for significant financial crimes, (5) Delete the email after reporting, (6) If you clicked links or provided information: Change passwords immediately, enable two-factor authentication, monitor accounts for suspicious activity, consider credit monitoring if personal information was shared, and contact your bank if financial information was compromised.

Frequently Asked Questions

External Resources