Tools
Phishing report builder
Load a reported email (.eml) and the factual parts of a SOC email report fill themselves in: headers, the sending IP from your trust boundary, authentication results, defanged indicators, attachment hashes and the timeline. The parts that need judgement get rule-based suggestions, for and against, that you accept, edit or dismiss. Not every reported email is phishing: you pick the verdict, and the report follows it. Export it as Markdown or PDF.
Loading…
How accurate is this?
Tested in November 2026 on 70 real emails: 40 phishing samples from Phishing Pot, 15 spam and 15 legitimate emails from the SpamAssassin public corpus. Every field was checked against an independent parser written in Python, and the sending IP against hand labels.
- Headers, authentication results, hashes and links matched on every email. Where the two parsers differed, this tool was right on inspection (folded or encoded headers, unusual display names).
- Sending IP: 52 of 55 correct. All 40 Microsoft-received samples were right, because Microsoft records the IP. The 3 misses were old mail with no recorded IP passing between two domains owned by the same person; each showed the “check this hop by hand” warning.
- The tool does not assume an email is phishing. It weighs signals for and against and gives a starting point. On the test set, no phishing sample came out as “looks legitimate” (39 of 40 looked malicious, 1 unclear), and no legitimate email came out as “looks malicious”. You choose the verdict, and the report follows it.
- Every suggestion labelled “Fact” was true. On legitimate mailing-list mail some true facts still appear (a different Return-Path, say); they are marked as weak, and the tool says when an email came through a list.
- Not handled: QR codes in images, links inside attachments (PDFs, Office files), and .msg files.
It drafts; you decide. Check every pre-filled value against the raw headers before you submit a report.