How scoring works, what each rule means, and important limitations.
Each analysis starts at 0. Points are added when suspicious indicators trigger. The total is capped at 100. Every triggered rule produces an evidence item explaining exactly why the score went up.
xn--) in hostname+25 ptsAccess-code users get additional analysis layers that improve detection depth.
This tool uses heuristic analysis — it checks for indicators of suspicious behavior, not definitive proof. A high score does not guarantee a scam, and a low score does not guarantee safety. The tool does not load or execute content from URLs, and email header parsing may not cover all edge cases.
Never visit suspicious URLs directly. This tool analyzes URLs without loading them in your browser. Use a sandboxed environment for deeper investigation.
Do not submit sensitive data. This is a static analysis tool. Don't paste passwords, personal info, or production credentials.