Identity
Who sent it?
We compare the visible From address with the envelope sender, Reply-To, message identifiers and authentication domains.
One-message investigation
Find what the email is trying to achieve.
A technical review connects identity, delivery and destination evidence without asking you to open the lure.
Destination
Where does it lead?
We extract actual link targets and distinguish them from the labels and logos shown to the recipient.
Objective
What does it want?
Evidence may support credential theft, payment diversion, fake renewal, malware delivery, lead generation or unwanted marketing.
What the review reads
The analysis starts with the full message source: visible and envelope identities, authentication results, delivery hops, message identifiers, encoded URLs and attachment metadata. It checks whether the brand story agrees with the technical sender and whether a reply or link changes the context.
Send the original, not only a screenshot
A screenshot records appearance. The .eml file or complete raw source adds delivery hops, authentication results, original domains and message identifiers. Those fields often change the conclusion. The public contact form does not accept files; secure delivery instructions follow checkout.
What you receive
The written result lists confirmed observations, likely explanations, evidence limits and the safest next step. It also records what should be preserved if the message belongs to a recurring campaign. Attribution is included only when independent records support it.
What one review does not promise
A review cannot guarantee a provider response, recover money or prove a person's identity from headers alone. It gives you a defensible decision record and identifies the appropriate next route when one exists.
Questions about the review
Can you tell me who the human sender is?
The review can identify technical services and domains supported by the evidence. A person's identity is stated only when independent records support it.
Will you open the suspicious link?
The first review extracts destinations without opening them. Any controlled observation must be necessary, authorized and described in the result.
Is a screenshot enough?
A screenshot helps explain appearance, but the original .eml or complete source is required for delivery and authentication evidence.