Email phishing analysis

Check an emailbefore you click anything in it.

Upload the message or paste its source. AntiBait reads the headers, sender authentication, links and attachments, and explains its verdict in plain language.

3 free scans per day, no account needed
Accepts .eml, .msg and .txt files
Free scans are not saved to a history

Drop an email file here

.eml, .msg or .txt · Up to 100 KB for .eml and .txt, 1 MB for .msg

Free scans available

By analyzing an email you agree to the terms of service and the privacy policy.

How it works

One message in, one explained verdict out.

01
Add the message
Drop an .eml, .msg or .txt file, or paste the raw source with headers.
02
Checks run
Authentication, links, attachments and the sender's identity are checked first. A language model then reads the whole message, and a second pass takes another look when its verdict and the checks disagree.
03
Read the verdict
You get a risk score, a verdict, the indicators behind it and what to do next.

Checks mail wherever it arrives

Gmail
Outlook on the web
Outlook add-in
Thunderbird add-on
Chrome
Firefox
Forward to analyze
REST API
Mail gateway
.eml and .msg upload

What is checked

Six checks per message. Each one shows up in the result.

Headers and routing

Received chains, Return-Path, Reply-To and Message-ID are compared for spoofing, and the brand a message speaks for is matched against the domain that actually sent it.

SPF, DKIM and DMARC

Authentication results are read from the message and checked against the sending domain. Results missing from a forward or an export are reported as not observed, not as a failure.

Links and domains

Every URL is extracted. Lookalike domains, mismatched link text and URL shorteners are flagged.

Attachments

File names and types are checked for executables, macros and double extensions. File contents are not opened.

Sender history

Sender domains and IP addresses are compared with indicators from earlier analyses.

Model reasoning

A language model reads the full message alongside these findings and explains its verdict. When the two disagree, a second pass reviews it.

API

The same verdict, from your own tools.

Send raw messages to the REST API with an API key and get the score, verdict, indicators and reasoning back as JSON.

One endpoint for single messages, one for bulk
Responses match what the web analyzer shows

Read the API docs

curl

curl -X POST https://antibait.io/api/analysis/advanced \
  -H "Authorization: Bearer $ANTIBAIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email": "<raw message source>"}'

response

{
  "success": true,
  "score": 78,
  "type": "phishing",
  "confidence": 94,
  "tags": ["SPF_FAIL", "SUSPICIOUS_LINK", "URGENT_LANGUAGE"],
  "reasoning": "The sender domain fails SPF and the link text…"
}

Beyond the web analyzer

Check mail where it arrives.

Browser extension

Analyze from your inbox

Check the open message in Gmail or Outlook on the web without copying its source. With Pro, every email you open is checked automatically.

One click from the open message
Works in Chrome and Firefox

Get the extension

Teams

Triage reported mail together

Shared campaigns, team history and indicator search for the people who handle reported phishing.

Share analyses into campaigns
Search indicators across the team

See plans

AntiBait Enterprise

A mail gateway in your network

Runs on your own infrastructure and checks inbound mail before it reaches inboxes, with sender authentication verified at the gateway.

Deployed on premises
Same detection engine as the web analyzer

Talk to sales

Who it is for

From one inbox to a whole organization.

Individuals

Check a message that asks for a password, a payment or a login before you act on it, or let Pro check every email for you and your household.

Small businesses

Give the team one place to check suspicious mail without a dedicated security staff.

Security teams

Use team history, campaigns and indicator search to triage the mail people report.

Developers and MSPs

Build email checks into your own products and client services through the API.

Pricing

Start free. Upgrade when you need more.

A free account adds scan history, PDF export and verdict reporting. Pro checks every email you open automatically, covers up to 3 people at home and sends you a weekly report. Try it for 7 days, no card needed.