PhishGuard analyses every email you open — instantly. Heuristics, header forensics, domain intelligence and Claude AI work together to give you a verdict you can trust.
What you get
PhishGuard runs 59 checks across seven detection categories the moment you open an email — in milliseconds, entirely in your browser.
Every email gets a full forensic assessment — PHISHING / SCAM / SUSPICIOUS / LEGITIMATE verdict, summary of what the attacker wants, key indicators, and a clear recommendation. Fires automatically 800ms after opening.
Links and file attachments are checked against 70+ security engines. Attachment bytes are hashed locally — only the SHA-256 hash is ever sent, never the file itself. QR codes in images are also decoded and checked.
Sender and link domains are looked up via RDAP and WHOIS. A domain registered 11 days ago, hosted on a Tor exit node, or registered through a high-risk registrar — all surfaced instantly with age and ASN shown.
"Open Full Headers" opens a 1200px popup: an Analysis tab with SPF/DKIM/DMARC badges and a hop table labelling every IP as PUBLIC or PRIVATE, plus a Raw Headers tab in RFC 2822 format ready for external tools.
Telenet, Proximus, VOO and Orange BE Zimbra webmail clients now get complete header retrieval — using the same appCtxt API as the Zimbra client itself, from the MAIN world. No CORS restrictions, no workarounds needed.
14 scam-specific patterns detect advance-fee fraud, fake lotteries, sextortion, investment scams and job scams — separate from phishing. Every link is checked for shorteners, IP addresses, credential harvesting paths and redirect chains.
Under the hood
A DOM mutation observer detects the new message. Sender, subject, headers, links and attachments are extracted immediately.
The scoring engine evaluates authentication results, domain signals, link quality, attachment risk and content patterns — in milliseconds, entirely on your machine.
Outlook uses EWS intercept. Gmail uses the internal ?view=om endpoint. Belgian Zimbra clients use MAIN world appCtxt injection. You get complete RFC 2822 headers on every supported platform.
RDAP, WHOIS and DNS lookups run for every unique domain — sender, reply-to, return-path and all link domains. Results feed both the sidebar and the AI report.
A structured forensic report is sent to Claude via the PhishGuard proxy. Within seconds: PHISHING, SCAM, SUSPICIOUS or LEGITIMATE — with full explanation and confidence level.
Risk score, colour-coded findings sorted by severity, AI verdict, domain intel, link VT scan, header popup and full report — all collapsible, always available on the right edge of your inbox.
Risk scoring
Every score is explainable. PhishGuard shows exactly which checks fired, their severity and how many points each contributed.
Display name spoofing, brand impersonation, Unicode lookalikes, homograph attacks, Reply-To anomalies, DKIM domain mismatch.
URL shorteners, anchor text mismatches, IP-based links, redirect chains, credential harvesting paths, suspicious TLDs, link bombing.
SPF/DKIM/DMARC pass/fail/none, triple-none pattern, mismatched DKIM signing domain, DMARC policy enforcement.
Domain age via RDAP, registrar reputation, disposable domain patterns, Punycode/IDN detection, free hosting platforms.
Dangerous file extensions, double extensions, password-protected archives with credentials in email body.
Advance-fee fraud, lottery scams, sextortion, investment scams, fake job offers, delivery fee scams, tracking pixels, HTML forms.
Your data
PhishGuard analyses the metadata that matters for security — never the content of your messages. Your emails stay private.
Simple pricing
The core heuristic engine is free forever. Pro adds Claude AI, VirusTotal scanning, domain intelligence and full header analysis — everything you need to be certain about an email.
💳 Secure payment via Stripe · 7-day refund policy · Cancel any time from your billing portal
Questions
Everything you need to know before installing.