Using PhishLens in Gmail

Use PhishLens in Gmail

Scan an email

1. Open the email.
2. Click Scan with PhishLens, next to the subject.
3. The verdict appears above the message: Looks safe or Looks like phishing, with a score for the wording, the links and the sender, chips for what was checked, and Why this verdict? with the words that weighed most.

See Read a verdict for what each part means.

In a conversation, PhishLens scans the message that is open (the latest one by default), not the whole thread.

Scan attachments

When an email has attachments, a Scan N attachments button appears under the attachment strip. Each file gets its own card with a verdict. For archives (ZIP, RAR, 7z), the card names the files inside that are the problem under Do not open. Details in Scanning attachments and files.

Full headers

With Read full headers on (default, see Settings), PhishLens reads the message through Gmail's "Show original", so the sender checks see every header (SPF, DKIM, DMARC, the servers it went through). The chip Full headers checked on the verdict tells you it worked. When Gmail does not serve it, PhishLens falls back to what is visible on the page.

Automatic scanning (optional)

Turn on Scan new emails automatically in Settings. Then:

• unread emails in the inbox list are scanned without a click;
• a small Safe or Phishing? pill appears on each scanned row;
• a notification appears when one looks like phishing;
• a status message shows at the bottom left of Gmail while it works.

Results are remembered, so the same email is not sent twice.

Tips

• If the button does not appear, reload the Gmail tab.
• PhishLens works with every Gmail account open in the browser (/mail/u/0, /mail/u/1, ...).