Layered detection · rules, structure, optional ML

Phishing email detection,
explained.

Analyze sender/domain risk or upload a complete email for authentication-header, identity-alignment, link, attachment, and content checks. An optional text model is evaluated with campaign-isolated splits and a phishing-recall-first threshold.

30
Sender risk signals
6
Detection layers
Auth headers
SPF, DKIM & DMARC in .eml
OCR + QR
Run in your browser
Check an Email Address How It Works
Try it

Live Demo

Analyze a sender address, paste subject/body text, or upload the original .eml message for the strongest available evidence.

What Are Disposable Email Addresses?

And why are they a security concern?

Definition

Disposable-email services provide shared, masked, or short-lived addresses. A provider-domain match identifies the service category but does not prove that an individual mailbox expires.

Why They Are Risky

  • Temporary inboxes can reduce sender accountability
  • They may be used to bypass account-verification policies
  • Privacy relays also have legitimate safety and privacy uses
  • A domain match is evidence, not proof of malicious intent

Known Temporary-Email Examples

mailinator.com guerrillamail.com 10minutemail.com tempmail.com yopmail.com maildrop.cc trashmail.com getnada.com
Test a disposable address:
Recent checks

Saved only in this browser: verdicts, scores and sender domains, never addresses or message text.

No checks yet. Results you analyze here will be listed.

Signals

Explainable Sender Signals

The sender-only mode evaluates 30 address and domain indicators. They are heuristic evidence—not probabilities learned from the UCI website dataset.

Brand & look-alike domains

High-risk heuristic

Flags brand names embedded in unrelated or look-alike domains—a more direct sender-risk signal than username length alone.

Senderpaypa1-verify.xyzHomoglyph · risky TLD
Brandpaypal.comExpected domain

Randomized usernames

Six-factor pattern check

Entropy, vowel ratio, digit mix, and repetition flag mailboxes that look machine-generated. Major providers need more factors before anything is reported.

xq7m9v2k4p8z@gmail.com

5 / 6 factors · reported as suspicious, not confirmed disposable

Risky TLDs

Domain reputation

Free or cheap extensions that are heavily abused in phishing raise the score.

.tk.xyz.top.gq.ml

Mailbox service type

Evidence-scoped

mailinator.comDisposable provider
relay.firefox.comPrivacy relay

A relay protects a real inbox and is not phishing evidence by itself.

Known provider context

Explainable heuristic

Recognizes common providers as context while still requiring users to inspect the complete message for spoofing and compromised-account attacks.

Authentication & identity alignment

Available with raw .eml input

Checks SPF, DKIM, and DMARC results plus From, Reply-To, and Return-Path domain mismatches.

SPF passDKIM failDMARC fail
Frombilling@paypal.com
Reply-Tosupport@paypa1-help.topMismatch
View all 30 sender signalsURL / address structure · domain reputation · username patterns
URL / Address Structure
8 features
  • IP address used as domain
  • Total email address length
  • URL shortener service domain
  • Multiple @ symbols
  • Double slash in domain
  • Hyphen in domain name
  • Subdomain depth
  • "http" token inside address
Domain Reputation
8 features · Highest signal
  • Known legitimate mail provider
  • Top-level domain type (TLD)
  • Domain label character length
  • Digits mixed into domain
  • High-traffic mail platform
  • Phishing keywords in domain
  • Phishing keywords in username
  • Suspicious / high-risk TLD
Username Patterns
14 features
  • Digit ratio in username
  • Username randomness (entropy)
  • Non-standard special characters
  • Username length
  • Brand domain spoofing
  • noreply / system sender type
  • Repeated character ratio
  • Digit-letter mix in domain
  • Abused country-code TLD
  • Auto-generated username pattern
  • … and composite risk features
Pipeline

How It Works

A layered detection pipeline designed to preserve strong phishing evidence.

01
Input Parsing
Accept a sender address, subject/body text, or a complete RFC 5322 message. Raw messages expose headers, MIME parts, HTML, and attachment names.
02
Sender Identity Checks
Evaluate suspicious domains, look-alike brands, risky TLDs, disposable patterns, and From / Reply-To / Return-Path alignment.
03
Message Structure Checks
Inspect SPF/DKIM/DMARC results, dangerous attachments, IP and shortened URLs, and visible-link versus destination mismatches.
04
Explainable Content Rules
Score urgency, credential requests, threats, obfuscation, and other suspicious behaviors. Attacker-controlled footer text cannot lower the score.
05
Optional Text Model
Fit TF-IDF inside group-isolated cross-validation, keep campaign/template families together, and learn an F2-optimized phishing threshold from training folds.
06
Conservative Evidence Fusion
Use the strongest credible evidence so a weak model score cannot average away clear structural or authentication risk.
Tech Stack
Python 3.13 scikit-learn FastAPI pandas NumPy Chart.js UCI ML Repo
Benchmark

Archived Website Benchmark

Historical course-notebook results on the UCI Phishing Websites dataset (2,211 held-out rows). These are not email-sender accuracy claims.

Show the archived results
Classifier Accuracy Precision Recall F1 ROC AUC
Loading…

Classifier Performance Comparison

Scope Matters

The UCI model learned URL and web-page features. PhishGuard does not reuse those learned weights for sender addresses. Sender checks are explicitly labeled heuristics; email-text metrics appear only when that model is enabled.