Is this email phishing?
Forward the suspicious message for a free phishing check. We’ll inspect its technical signals and reply with a clear, plain-language risk report.
How it works
No account or copy-and-paste form. Forwarding the message gives the checker more technical evidence to examine.
Forward the email
Forward the suspicious email to harry@protego.me. Forward it as an .eml attachment when your mail app supports that option; a normal forward also works, but may preserve fewer technical headers.
Wait a few seconds
Most replies arrive within seconds. A slower backup check runs every 10 minutes if the fast path is unavailable, although mail-provider delays and temporary service failures are still possible.
Read the verdict
You get a reply from verify@protego.me with a color-coded risk score (green, orange, or red) and a plain-language breakdown of what was checked.
What we check
Ten checks combine into one score, so one weak signal on an otherwise normal email does not create an alarming verdict by itself.
Sender authentication
Does the message actually pass the sender’s own SPF, DKIM, and DMARC checks, or is that missing?
Look-alike domains
Is the sending domain a near-copy of a real brand, like "micros0ft.com" or a brand name hidden inside a longer domain?
Domain age & reputation
Was the sending domain registered days ago? Is it already flagged as malicious by Google Safe Browsing or Spamhaus?
Reply-To mismatch
Does a reply actually go back to the visible sender, or somewhere else entirely?
Display name spoofing
Does the name shown ("Microsoft Support") match the real sending domain, or is it faked?
Links & QR codes
Do the links go where their text claims? Are any known-malicious? QR codes in images are decoded and checked too.
Attachment risk
Do attachment hashes match known malware, or do filenames, file signatures, and encryption settings hide elevated risk?
Pressure language
Does the message use urgency ("act now," "24 hours") combined with a request for a password, payment, or personal details?
Why forwarding is stronger than pasting the message
A pasted message can reveal suspicious wording, but it often loses the sender authentication and routing evidence needed to investigate impersonation. Forwarding the original message, especially as an .eml attachment, lets Protego examine technical headers, domains, links, QR codes, attachments, and content together.
| Method | Evidence it can examine | Main limitation |
|---|---|---|
| Paste into an AI checker | Wording, urgency, and visible links | Usually loses authentication and routing headers |
| Check one link | The submitted destination and reputation signals | Does not evaluate sender impersonation or the complete message |
| Forward to Protego | Headers, domains, links, QR codes, attachment signals, and wording | Automated evidence review, not a guarantee or a human investigation |
The original email is deleted
Deleted after the check
The email itself, its body, attachments, and any images, is deleted from our mailbox as soon as the check finishes. It doesn’t sit around afterward.
Limited metadata remains
We keep the sender address, sender domain, subject line, risk score, and each check’s pass, warning, or failure status for usage measurement and abuse prevention. We do not keep the message body, extracted links, attachment names, files, or images.
Questions
Is this actually free?
Yes. You can check up to 10 messages per sender each day, subject to a site-wide limit that keeps the service available and prevents automated abuse. There’s no account, signup, or payment involved.
What happens to the email after it’s checked?
It’s deleted from our mailbox right after the checks run. We retain the sender address, sender domain, subject line, risk score, and each check’s status for usage measurement and abuse prevention, but not the message body, extracted links, attachment names, files, or images.
How fast is the reply?
Usually within a few seconds. There’s also a backup check that runs every 10 minutes if the fast path is unavailable. Delivery can still be delayed by your email provider or a temporary service issue.
Can it be wrong?
It’s a strong first read, not a guarantee. A LOW score means nothing suspicious was found by these specific checks, not that the email is guaranteed safe. When in doubt, verify through a channel you already trust: call the person or company directly using a number you already have, not one from the email.
Does it work for any kind of email?
It can check personal or work email. An .eml attachment preserves the strongest technical evidence. A normal forward can still be checked, but some authentication headers may be missing; pasted text and screenshots provide the least evidence.
Related protection tools
Got a suspicious email right now?
Forward it and you’ll have an answer before you’d have finished reading it a second time.
Forward to harry@protego.me →Own the domain instead of just receiving mail on it? Check Email Security Checker to see if your domain can be spoofed.