Phishing Email Analyzer

Phishing Email Analyzer examines a suspicious email and returns a verdict — phishing, suspicious, or likely safe — with a 0 to 100 risk score and the specific indicators behind it, so the answer is something you can check rather than something you have to trust. It works through the three places phishing actually shows itself. Header authentication: whether SPF, DKIM and DMARC pass, and whether the visible From address agrees with the Return-Path and Reply-To. Links: every URL is extracted and scored statically for the displayed host not matching the real one, punycode and homoglyph lookalikes, raw IP hosts, shortener chains, and paths that lead to credential forms. And language: the urgency and pressure patterns, and the requests for credentials or sensitive data, that social engineering depends on. The scoring is entirely deterministic. A language model writes the explanation and nothing else — it cannot change the verdict or move the score by a single point. Without a model the explanation falls back to a template and the verdict is unchanged. The safety design is the reason this can be pointed at a live suspicious email. No URL is ever fetched. No attachment is ever opened. The message body is treated as untrusted data throughout — injection lead-ins are defanged and never obeyed — which matters here more than anywhere, because analysing a phishing email means feeding an assistant text written specifically to manipulate whoever reads it. Each check is callable alone. `check_headers` answers the authentication question in isolation. `extract_and_score_urls` scores the links without a verdict. `assess_social_engineering` returns the pressure and credential-request signals. `run_full` does all of it and writes the explanation. The output is advisory. It never quarantines, blocks or reports anything on your behalf. No connections and no credentials — paste the raw email, or just the headers, or just the body. Built for security teams, IT helpdesks and anyone who gets forwarded "is this real?" several times a week.