Cybersecurity tool · 100% client-side · MITRE ATT&CK T1566
Phishing Email Red-Flag Scanner
Paste any email body and see a composite 0–100 risk score plus inline-highlighted red flags across five detection categories: urgency manipulation, suspicious URL patterns, brand impersonation, credential harvesting, and malware-delivery indicators. Each flag includes a "why this is suspicious" explanation tied to real attack patterns.
Free. No account. The body never leaves your browser.
100% client-side. The email body is never sent to a DecipherU server, never logged, never stored.
Risk score
84 / 100
Critical phishing
9 red flags detected across 4 categories. Mapped to MITRE ATT&CK T1566 (Phishing).
Email body with red flags highlighted
From: it-security@microsoft-365-support.zip Subject: URGENT: Your account will be suspended in 24 hours Dear Customer, Our security team has detected unusual activity on your Microsoft 365 account. Please verify your identity immediately to prevent suspension of your account. Click here to sign in and confirm your password: http://192.0.2.45/login.php For verification, please share the 6-digit code we just sent to your phone. Failure to respond within 24 hours will result in permanent termination of your access. Microsoft IT Department
Detected red flags · why each one matters
Urgency / authority 4
Phishing campaigns push immediate action to bypass careful judgment. Legitimate organizations rarely require action 'within 24 hours' via email.
URGENTimmediatelywithin 24 hoursThreats of account suspension, legal action, or service loss create fear that overrides skepticism. Legitimate notifications use neutral language.
suspendedterminationPhishing emails often impersonate IT, HR, or executives. The named role is rarely verified inside the email itself.
IT DepartmentGeneric salutations like 'Dear Customer' or 'Hello User' suggest a mass-send template, not personalized communication from an organization that knows you.
Dear CustomerSuspicious URL 1
Legitimate organizations never use raw IPs in user-facing links. An IP-literal URL is one of the strongest indicators of either phishing or attacker infrastructure.
http://192.0.2.45/login.phpBrand impersonation 1
Phishing campaigns invoke trusted brand names to lower the reader's guard. When the brand name appears with a 'verify your account' or 'sign in' instruction, the combination is the fingerprint.
MicrosoftCredential harvesting 3
Legitimate services NEVER ask you to share an OTP, MFA code, or verification code, they generate one on their server. An email asking you to share one is a credential-harvesting attempt or an MFA bypass attack.
share the 6-digit codeNo legitimate organization asks for your password by email. This is one of the oldest and most reliable phishing fingerprints.
confirm your passwordLogin or verification links in unsolicited email are how credential phishing kits operate. Legitimate email rarely sends you to a sign-in page; you go to the service directly.
Please verify your identityHow to investigate safely
- Do not click any link or open any attachment. Investigate from a separate device or sandboxed VM if you must.
- Verify the sender out-of-band. If the email claims to be from a vendor, look up their support number on their website (not the email) and call.
- Hover over links to see the real destination. Anchor text and href can differ, the real URL is the one that matters.
- Report it. Forward to your SOC, IT security inbox, or a phishing-report channel like Microsoft's
junk@office365.microsoft.comor APWG'sreportphishing@apwg.org. - Delete only after reporting. Premature deletion makes incident response harder if other employees received the same campaign.
Common questions
How does the scanner work without sending my email anywhere?
Every detection runs in your browser as a regex or pattern test against the pasted text. Nothing is sent to any DecipherU server, no logs are kept, and no cookies are set for this scan. Open the browser network tab while you use it, there are no outbound requests.
Is a 100/100 score really phishing?
A composite score in the 75-100 band means the email exhibits multiple critical-severity patterns that are essentially never present in legitimate communication: requests to share OTP codes, raw IP URLs, password-protected archives, and brand-impersonation language combined with credential asks. A 100/100 still requires human judgment, corner cases exist (e.g., poorly-worded internal IT emails), but the burden of proof shifts to the sender.
Will the scanner catch every phishing email?
No. Highly-targeted spear-phishing (especially business email compromise) often uses none of these patterns, clean grammar, credible brand mention, no obvious urgency, and a well-disguised URL. The scanner is calibrated to catch the high-volume bulk-phishing patterns that account for the majority of real-world incidents. For BEC defense, technical controls (SPF, DKIM, DMARC, payment-process verification) carry more weight than text analysis.
What's the MITRE ATT&CK mapping?
All five detection categories map to T1566 (Phishing) in MITRE ATT&CK. Specifically: T1566.001 (Spearphishing Attachment) for the malware-delivery category, T1566.002 (Spearphishing Link) for the suspicious-URL and credential-harvesting categories, and T1566.003 (Spearphishing via Service) for brand-impersonation patterns that ride on legitimate platforms.
Can I use this on a .eml file?
Yes, open the .eml in a text editor and paste the body (and headers if you want). The scanner doesn't parse MIME structure; it scans the raw text. If you have a stack of .eml files to triage, run them through your own SOC tooling, this scanner is built for one-off curiosity and quick triage, not for bulk SOC workflows.