Is this email really from who it says?

Paste the sender, or the email's full headers. We check for fake brand senders, lookalike domains, spoofing and reply-to tricks.

Sender or email headers

The sender line alone can be faked. For the strongest check, paste the full headers.

Try an example:

We never store what you paste. Headers can contain names and addresses, so they're only used for this check.

What we check

How fake senders give themselves away

Name vs. address

"PayPal" or "IT Helpdesk" in the name, but sent from Gmail or an unrelated domain.

Lookalike domains

Misspellings like "paypa1" or "micros0ft", lookalike characters and brand-new domains.

Spoofing checks

With headers: whether the email actually passed SPF, DKIM and DMARC, the checks that prove where it came from.

Reply-to tricks

Replies quietly redirected to another address, the classic way invoice and payroll fraud steals money.

Also check the links in it

Paste the whole message into the link checker to check every link at once.

Check links Report a scam