Is this email phishing?
Forward the suspicious message for a free phishing check. We’ll inspect its technical signals and reply with a clear, plain-language risk report.
Tip: the button starts a new, empty message to us. For the strongest check, use Forward (or Forward as attachment) on the suspicious email itself and send it to this address.
How it works
No account or copy-and-paste form. Forwarding the message gives the checker more technical evidence to examine.
Forward the email
Forward the suspicious email to check@verify.protego.me. Forward it as an .eml attachment when your mail app supports that option; a normal forward also works, but may preserve fewer technical headers.
Get a quick acknowledgment
verify@protego.me sends back a short "Checking now" note almost immediately so you know the message arrived. Mail-provider delays and temporary service failures can delay or prevent replies.
Read the verdict
A few seconds later verify@protego.me sends the full results: a color-coded risk score (green, orange, or red) and a plain-language breakdown of what was checked.
What we check
Ten checks combine into one score, so one weak signal on an otherwise normal email does not create an alarming verdict by itself.
Sender authentication
Does the message actually pass the sender’s own SPF, DKIM, and DMARC checks, or is that missing?
Look-alike domains
Is the sending domain a near-copy of a real brand, like "micros0ft.com" or a brand name hidden inside a longer domain?
Domain age & reputation
Was the sending domain registered days ago? Is it already flagged as malicious by Google Safe Browsing or Spamhaus?
Reply-To mismatch
Does a reply actually go back to the visible sender, or somewhere else entirely?
Display name spoofing
Does the name shown ("Microsoft Support") match the real sending domain, or is it faked?
Links & QR codes
Do the links go where their text claims? Are any known-malicious? QR codes in images are decoded and checked too.
Attachment risk
Do attachment hashes match known malware, or do filenames, file signatures, and encryption settings hide elevated risk?
Pressure language
Does the message use urgency ("act now," "24 hours") combined with a request for a password, payment, or personal details?
Why forwarding is stronger than pasting the message
A pasted message can reveal suspicious wording, but it often loses the sender authentication and routing evidence needed to investigate impersonation. Forwarding the original message, especially as an .eml attachment, lets Protego examine technical headers, domains, links, QR codes, attachments, and content together.
| Method | Evidence it can examine | Main limitation |
|---|---|---|
| Paste into an AI checker | Wording, urgency, and visible links | Usually loses authentication and routing headers |
| Check one link | The submitted destination and reputation signals | Does not evaluate sender impersonation or the complete message |
| Forward to Protego | Headers, domains, links, QR codes, attachment signals, and wording | Automated evidence review, not a guarantee or a human investigation |
What we retain
Message privacy
Our scan logs do not retain message bodies, attachments, or images. The inbound mail provider may retain the original message under its own retention policy.
Limited metadata remains
We keep the sender address, sender domain, subject line, risk score, and each check’s pass, warning, or failure status for usage measurement and abuse prevention. We do not keep the message body, extracted links, attachment names, files, or images.
Questions
Is this actually free?
Yes. You can check up to 10 messages per sender each day, subject to a site-wide limit that keeps the service available and prevents automated abuse. There’s no account, signup, or payment involved.
What happens to the email after it’s checked?
Messages are processed through our inbound mail provider, which may retain the original under its retention policy. We retain the sender address, sender domain, subject line, risk score, and each check’s status for usage measurement and abuse prevention, but not the message body, extracted links, attachment names, files, or images.
What will I receive?
Usually two replies from verify@protego.me: a short "Checking now" acknowledgment almost immediately, then the full results with a color-coded risk score and a per-check breakdown a few seconds later.
How fast is the reply?
Usually within a few seconds. Delivery can still be delayed by your email provider or a temporary service issue.
Why didn’t I get a reply?
A few reasons are normal. Automated or bulk mail (newsletters, auto-responders, notification senders), messages from Protego’s own system addresses (such as verify@ and support@), and DMARC reports are skipped and get no reply. You can also hit the daily limit of 10 checks per sender or a site-wide cap, in which case nothing is sent back. If none of those apply, check your spam or junk folder, since the reply can land there.
Can it be wrong?
It’s a strong first read, not a guarantee. A LOW score means nothing suspicious was found by these specific checks, not that the email is guaranteed safe. When in doubt, verify through a channel you already trust: call the person or company directly using a number you already have, not one from the email.
What should I do if the email is phishing?
Do not click its links, open its attachments, scan its QR codes, or reply. Report it with your mail app’s phishing or junk option (at work, use your organization’s report button or tell IT), then delete it. If you already entered a password, change it on that site and anywhere you reused it, and turn on multi-factor authentication. If you shared card or bank details, contact your bank.
Does it work for any kind of email?
It can check personal or work email. An .eml attachment preserves the strongest technical evidence. A normal forward can still be checked, but some authentication headers may be missing; pasted text and screenshots provide the least evidence.
Related protection tools
Got a suspicious email right now?
Forward it and you’ll have an answer before you’d have finished reading it a second time.
Forward to check@verify.protego.me →Own the domain instead of just receiving mail on it? Check Email Security Checker to see if your domain can be spoofed.