Phishing Email Checker: Scan a Suspicious Email in Seconds

Got an email that feels off — an unexpected invoice, a "your account will be suspended" warning, or a link from someone who doesn't usually send you links? Upload or paste it into TrustCan and it will pull out the sender headers, authentication results, and every link in the message, then check each link against real threat-intelligence providers.

You don't need to be technical to use it. Drop in the file (or paste the raw text if you don't have a file), and TrustCan does the rest in a few seconds.

• Sender details: From, Reply-To, Return-Path, and Message-ID — including whether the Reply-To address quietly points somewhere different from the From address, a common business email compromise tactic.
• Authentication results: SPF, DKIM, and DMARC status pulled from the email's own headers.
• Every link in the message: each one is checked individually against VirusTotal, AbuseIPDB, Shodan, domain-age data, TLS certificate status, and lookalike-domain analysis — the same engine behind our link checker.
• Link mismatches: cases where the visible text of a link says one domain, but the actual destination is somewhere else entirely.

• Urgency or fear ("act within 24 hours or your account is locked").
• A generic greeting instead of your actual name.
• A request to change payment or banking details.
• An unexpected attachment, especially a .zip, .exe, or password-protected file.
• A sender address or Reply-To that doesn't match who they claim to be.

TrustCan never tells you an email is definitively "safe." Instead you'll see one of several honest result states — from MALICIOUS or SUSPICIOUS down to NO KNOWN THREATS, which means no current source flagged a problem — not that nothing is wrong. If evidence is too thin to say anything useful, you'll see INCONCLUSIVE instead of a guess.