WT-049
?!
EMAIL / LOCAL UTILITY
Email Safety Checker
Upload an .eml file or paste raw email source to check sender identities, authentication results, links, attachments, and phishing warning signs.
PHISHING CHECK
LOCAL FIRST
OPT-IN REPUTATION
EMAIL SAFETY CHECKERPHISHING / SPAM / ATTACHMENT TRIAGE
CHECK AN EMAIL WITHOUT OPENING ITS LINKS OR ATTACHMENTS
LOCAL FIRST
Upload an .eml file or paste the raw email source. WhateverTools checks sender identity, SPF/DKIM/DMARC verdicts, misleading links, phishing language, bulk-mail signals, and attachment bytes in your browser. An optional Deep Reputation Check can compare extracted indicators against public threat-intelligence sources.
OR
READYNo email has been analyzed yet.
OVERALL VERDICT
LOW STATIC RISK
This is a risk assessment, not a guarantee that an email is safe.
RECOMMENDED ACTION
Review the evidence before trusting the message.
IDSENDER IDENTITY / IMPERSONATION
Compares the visible sender, envelope sender, Reply-To destination, and common brand impersonation patterns.
DISPLAYED FROM—
→
RETURN-PATH—
→
REPLY-TO—
Identity comparison will appear here.
AUTHREPORTED EMAIL AUTHENTICATION
SPFUNKNOWNNo result parsed.
DKIMUNKNOWNNo result parsed.
DMARCUNKNOWNNo result parsed.
These are verdicts already recorded in the message by receiving mail systems. WhateverTools does not re-run DNS checks or cryptographically re-verify DKIM.
!WHY WE GAVE THIS VERDICT
Signals are weighted by type. Passing authentication is useful evidence, but it does not make a malicious message safe if an attacker controls the authenticated domain or account.
URLLINK ANALYSIS
Checks the actual href, displayed link text, registered/root domain, IP links, shorteners, Punycode, misleading @ syntax, sensitive-action paths, and common brand lookalikes. Links are parsed but never opened.
NO LINKS FOUND
FILEATTACHMENT ANALYSIS
Decodes MIME attachments locally, compares the filename with the actual file signature, checks dangerous extensions, macro indicators, encrypted ZIPs, active PDF/HTML features, and calculates a SHA-256 fingerprint. This is static inspection — not a malware sandbox or antivirus verdict.
NO ATTACHMENTS FOUND
NETEXTERNAL REPUTATION EVIDENCE
If Deep Reputation was enabled above, WhateverTools automatically checks the extracted URL and attachment-hash indicators after the local analysis finishes. External results stay separate from the local phishing, spam, and attachment scores.
Deep Reputation is off. Enable it above before clicking CHECK EMAIL if you want external evidence too.
SHOW TECHNICAL DETAILS
No technical details parsed yet.
PRIVACY NOTE: The normal email analysis, MIME parsing, attachment inspection, and SHA-256 calculations happen in this browser. WhateverTools does not upload or save the message. If you enable INCLUDE DEEP REPUTATION CHECK, only the extracted URLs and SHA-256 hashes being checked are sent to the external reputation providers identified in the results; the email body and attachment bytes are never sent by that deep-check request.
FIELD NOTE / 049
Phishing, spam, and dangerous attachments are different problems.
A legitimate newsletter can have a high bulk-mail score and almost no phishing risk. A targeted credential theft message may have a very high phishing score without looking like ordinary spam. Attachment risk is separated again so an otherwise believable email cannot hide a dangerous executable, disguised file, macro document, active PDF, or credential-stealing HTML attachment inside one generic score.