Email X-Ray
Email X-Ray is a free phishing email checker. Copy a suspicious email and paste it below. We’ll score it, highlight the sentences that look like phishing, and check where every link really goes, including the hidden address behind “Click here”.
Try an example:
Private by design: the email is checked on your device. Nothing is uploaded or stored, links are never opened, and images in pasted emails aren’t loaded.
How to use it
- Open the suspicious email. Select all of it (Ctrl+A or Cmd+A inside the message), including the sender line and subject if you can, and copy it.
- Paste it into the box with a normal paste (Ctrl+V). If your browser copied the formatting, the tool reads the real addresses behind every link and button and tells you how many it found.
- Press Check email (or Ctrl+Enter).
- Read the score and the reasons. The sentences that triggered each reason are highlighted in a copy of the email, numbered to match.
- Check the Links list to see what each link says and where it really goes.
If you enjoy what we do, consider supporting us. Every little bit means the world! Support Catpool on Ko-fi
What the score means
The score runs from 0 to 100 and adds up every warning sign we find. Low risk (under 15) means none of the usual phishing tricks showed up. Suspicious (15 to 44) means some signs are there, so check with the sender another way before acting. Likely phishing (45 or more) means several strong signs, such as a spoofed link plus a request to log in. It’s a guide, not a guarantee: a short, well-written scam can score low, and a genuine but pushy marketing email can score higher than you’d expect.
What it looks for
Spoofed and dangerous links
The classic phishing trick is a link that says one address but goes to another. When you paste a formatted email, we compare the visible text of every link with its hidden destination. We also run each address through the same engine as our Link X-Ray tool, which spots lookalike domains (paypa1.com), brand names on someone else’s domain (microsoft.com.account-verify.top), raw IP addresses, risky domain endings and link shorteners. If the email talks about a company and the links go somewhere else, that’s flagged too.
Requests for details or money
Messages asking you to “verify your account”, “confirm your payment details” or “enter your password” are flagged as strong signs, because legitimate companies don’t ask for these by email. So are changed bank details, overdue invoices that must be paid today, and requests for gift cards or cryptocurrency.
Pressure, threats and fake problems
Phishing works by making you act before you think. We highlight deadlines (“within 24 hours”), threats (“your mailbox will be suspended”), fake account problems (“unusual sign-in activity”, “your password expires today”) and prize or refund bait.
CEO fraud and attachment lures
Business email compromise often starts with “Are you at your desk? I need a quick favour” and asks you to keep things confidential. We also flag fake shared documents, voicemail attachments, “enable editing” instructions and requests to scan a QR code.
The sender
If the pasted email includes a sender line, we check whether a company name is coming from a free email account or from a domain that doesn’t belong to that company. For a deeper check of where an email really came from, use our Header X-Ray with the full headers.
Privacy
Everything happens in your browser. The email isn’t uploaded, stored or shared, and Catpool never sees it. Links are only read as text: they’re never opened, followed or previewed, and images in a pasted email aren’t loaded, so no “tracking pixel” can tell the sender you looked. You can safely check emails that contain personal details, though it’s always wise to remove account numbers before sharing an email with anyone else.
What to do with a phishing email
- Don’t click, reply or open attachments. If you need to check your account, type the company’s web address yourself or use their app.
- Report it: forward the email to report@phishing.gov.uk. Scam texts can be forwarded free to 7726.
- Check requests another way: for invoices, bank detail changes or a boss asking for a favour, phone a number you already have.
- If you’ve clicked or paid: call your bank on 159, change any password you typed (and anywhere else you use it), turn on two-step verification, and report it to Report Fraud (formerly Action Fraud).
Frequently asked questions
Why does it say no links were found when the email had buttons?
Some apps copy emails as plain text, which loses the hidden link addresses. Try copying from your email in a web browser, or use “Show original” and paste the HTML source. You can also right-click a link, choose “Copy link address” and paste that into our Link X-Ray.
A genuine email scored as Suspicious. Is the tool wrong?
Real companies sometimes write like phishers: deadlines, “click here” and tracking links that go through a mailing service. The reasons tell you exactly what was flagged so you can judge for yourself. When in doubt, go to the website directly instead of using the link.
Does it work for other languages?
The wording rules are written for English emails and UK scams. Link checks work for any language.
Can it check text messages and WhatsApp?
It will work, but our Text X-Ray is tuned for short messages, parcel texts and “Hi Mum” scams.
Related: Catpool home, Security, Header X-Ray, Link X-Ray, Text X-Ray, QR X-Ray.
