Phishing Awareness Tool

Spot the warning signs
in suspicious emails

Paste an email below to check it for common phishing clues like sender mismatches, strange links, urgent language, and requests for private data.

Email Details

Include the display name if you have it: Name <email@domain.com>
Found in the email headers. Sometimes it differs from the sender.
Copy links from the email (right-click and choose Copy link address) instead of clicking them.

Upload .eml File

Why use a .eml file?

It is faster than copying each field by hand. Uploading the saved email automatically fills in the subject, sender, reply-to address, links, and message body in one step, and also checks hidden technical headers (SPF, DKIM, and DMARC) that are not visible in a normal inbox view.

How to save an email as .eml:

  • Gmail: Open the email, click the three dots (⋮) in the top-right corner of the message, and select Download message.
  • Outlook: Open the email, click the three dots (⋯) or File menu, and choose Save As / Download.

Before We Analyze This Email

PhishSonar is an educational tool that checks for common phishing clues. It cannot guarantee that an email is safe, and you should never rely on it alone before clicking links or sharing sensitive details.

What PhishSonar checks

Sender & Reply-To mismatch

Replies going to a different domain than the address shown as the sender.

Suspicious links

Links with unusual domain endings, raw IP addresses, or fake brand names.

Urgent language

Pressure tactics meant to rush you into acting before you check the details.

Sensitive info requests

Messages asking for passwords, card numbers, or personal identity details.

Attachment prompts

Requests to open unexpected files or enable macros in a document.

Display name spoofing

Well-known company names paired with unrelated email addresses.