Repository navigation
Reading a verdict
- Looks safe: nothing points to phishing.
- Looks like phishing: do not click the links, do not open the attachments, do not reply with information. Check with the sender through another channel you already know.
- Could not look inside (attachments): the file is password-protected, a disk image or an archive PhishLens cannot open. Attackers use this to get past scanners. Open it only if you expected it.
| Score | What it looks at |
|---|---|
| Message content (Wording) | The text, read by a language model trained on phishing and normal emails. |
| Links in the email (Links) | The addresses the links really point to (not the text you see), checked by a model and by threat-intelligence lists. |
| Sender & headers (Sender) | Whether the sender is who it claims to be: SPF, DKIM and DMARC, reply-to tricks, the route the email took. |
A high score is a warning sign, not a verdict on its own. PhishLens combines the three with the evidence below.
- Flagged by Google Safe Browsing (or PhishTank, URLhaus, Spamhaus): a link is on a known list of dangerous sites. This alone makes the verdict "phishing", whoever the sender is.
- DKIM verified / Delivered by Gmail / Trusted sender: the sender's identity was confirmed. The wording score then weighs less, because real banks and universities also write "verify your account".
- DMARC fail, SPF fail: the email claims a sender it could not prove.
- Forwarded: the trust of the person who forwarded it is not applied to the forwarded content.
- Shared file: the email points to a shared document or form (Google Drive, OneDrive, Dropbox...), a common phishing trick. Open it only if you expected it.
Click it to see the words that weighed most in the wording score: red words push towards phishing, green words towards safe, a stronger colour means a stronger effect.
Under the verdict, PhishLens says which language it detected. Click Correct, or Not this language and pick the right one: the answer stays in your history and helps improve detection if you share your statistics.
Wrong verdict? Report it opens the text that would be sent, with names, your own name and address, email addresses, phone numbers, long numbers and the paths of links already removed. Delete anything else you want, tick the box and press Send: it goes to PhishLens Cloud with the verdict and the scores, nothing else. You get a reference; quote it in an issue if you want the report deleted. See Privacy in short.
- The wording score is less proven in languages the model was not tested on, and technical documents full of security words (passwords, accounts, credentials) can be over-scored (see Languages).
- A brand-new phishing site that no list knows yet can pass the link checks.
- PhishLens does not open links or run attachments: it reads them.
If a verdict is wrong, mark it Wrong in the popup's Insights view. It helps measure PhishLens on real mail.
PhishLens, GNU AGPL-3.0 license. Written for the current version; see the changelog for what changed.