# Look inside a suspicious email before you open anything

> Drop a saved email or attachment and see whether it hides macros, PDF actions, scripts or links that imitate banks and couriers. Nothing is uploaded.

Free in-browser tool (no upload): https://www.mauriziofonte.it/tools/suspicious-email-analyzer

Drop the saved message or the attachment that worries you. The tool takes it apart in your browser without opening it and tells you **what it would try to do**: run a macro, fetch a program, send you to a page dressed up as your bank. It is not an antivirus, and it will never tell you a file is harmless.

## How to use it

1. **Save the email or the attachment** - In Gmail open the email, three-dot menu, Download message: you get an .eml file. In Outlook drag the email to the desktop (an .msg file) or save just the attachment.
2. **Drop it on the box** - Or tap the box to pick the file on your phone. The analysis starts by itself and takes a few seconds; the file stays on your device.
3. **Read the outcome and the sentences below it** - At the top you get one of four outcomes, then the list of what the file would do, worst first, and a table of the domains it mentions.
4. **Hand the report to whoever helps you** - Copy the report or download the JSON for your IT person. The technical detail shows every part of the file and the rule behind every finding.

## Why take the file apart instead of opening it

A dangerous document does nothing until you open it with the right program: Word runs the macro, the PDF reader runs the JavaScript, Windows follows the shortcut. This tool uses none of those programs. It reads the file as a sequence of bytes, rebuilds its structure (the ZIP inside the .docx, the VBA project inside the .xlsm, the objects inside the PDF, the attachments inside the email) and lists the parts able to act on their own.

An antivirus compares the file with signatures of attacks it has already seen, and last night's attack often has no signature yet. The reasoning here is different: look for capabilities a document should not have. A macro that runs on opening and starts PowerShell, a Word template fetched from an unknown server, a PDF where one link covers the whole page. These techniques change far more slowly than individual attacks, and you can spot them without knowing who used them.

Since 2022 Office blocks macros in files downloaded from the internet, so attackers moved on: archives with scripts inside, disk images, .lnk shortcuts, HTML pages that assemble a file in the browser, PDFs that lead to a fake login. That is why the tool also reads the email around the attachment: who sent it, where replies go, where the links really point and how many days the domains have existed.

## Glossary

- **Macro**: A small program inside an Office document. It can start on opening and do almost anything the user could do on the computer.
- **Phishing**: An email posing as a known sender, such as a bank, a courier or a utility, to make you open an attachment or type your login on a fake site.
- **SPF, DKIM and DMARC**: Checks the receiving server runs to make sure the sender may use that domain. The result is written in the Authentication-Results header.
- **HTML smuggling**: An HTML page that builds a file right in the browser and offers it as a download, so the file never crosses the mail filters as an attachment.
- **Quishing**: Phishing through a QR code: the link is not written in the email but drawn in an image, and it opens on a phone, where filters are often missing.
- **.lnk shortcut**: A Windows shortcut. It can wear a PDF icon while actually starting PowerShell or another program with any command line.
- **Look-alike domain**: A domain name imitating a company's, with swapped letters or added words (paypa1, microsoft-support-login, poste-it-verifica).
- **RDAP**: The domain registries' lookup service that tells, among other things, when a domain was registered. For .it domains the .it Registry whois is used.

## Frequently asked questions

### Is this an antivirus?

No. An antivirus compares the file with known attacks and gives you a verdict. This tool takes the file apart and tells you what active content it holds and what it would try to do, without ever calling it harmless. Use it as a second opinion next to the protection you already have, not as a replacement.

### Is my file uploaded anywhere?

No. The file is read in your browser by a component that is forbidden any connection. Only the domain names found in it reach the server, to look up their age and reputation, along with the page's usage statistics. The full list is in [What stays on your device](#cosa-esce).

### The outcome says nothing was found. Can I open the file?

It means the file shows none of the signs the tool knows, not that it is harmless. If you were expecting the email and the sender is who they claim to be, go ahead. If you were not, confirm by phone or by writing to an address you already have, never by replying to the email itself.

### Which files can I check?

Saved emails (.eml and Outlook .msg), Word, Excel and PowerPoint documents including macro-enabled ones, LibreOffice files, PDF, RTF, ZIP, RAR, 7z, tar, gzip and ISO archives, Windows shortcuts, Internet shortcuts, scripts, HTML and SVG pages, OneNote notebooks and signed .p7m files. Up to 50 MB.

### The attachment is a ZIP whose password is written in the email. What now?

The tool lists the files inside and tells you whether any of them runs on a double click, but it does not open archives locked with a password. An archive with its password in the email body is a classic way to sneak malware past filters: if you were not expecting it, do not open it.

### I have the password of an encrypted document. Can it be analyzed?

Yes, for encrypted Word, Excel and PowerPoint documents and for PDFs that ask for a password. When the tool meets an encrypted file a field appears: type the password and press Analyze. The password is used only in your browser and is never sent.

### Why is an Excel file with macros not flagged as dangerous?

Because plenty of businesses use macro workbooks every day. The tool tells them apart: a macro that just sits there is low, a macro that runs on opening needs explaining, a macro that runs on opening and starts programs, downloads files or calls system functions is critical. Professional analysis tools such as mraptor, part of oletools, draw the line in the same place.

### What does it mean that a domain was registered a few days ago?

Phishers register fresh domains for every campaign and drop them after a few days, once they land on blocklists. A link to a domain born last week that claims to be your bank is a strong sign. An old domain, on its own, proves nothing.

### How can I tell whether an email from my bank or a courier is real?

Look at the real domain of the sender and of the links, not at the display name: the tool shows them and flags those imitating a brand. Banks and couriers do not ask for passwords or codes by email. When in doubt, type the site address yourself or use the official app.

### I already opened the attachment. What do I do?

Disconnect the computer from the network, leave it on and tell whoever looks after your IT. From another device, change the passwords used on that computer, starting with email and banking. Report the email to your national cybercrime reporting service.

### Does it work on a phone?

Yes. On Android download the attachment and pick it from the box; on iPhone first save the attachment to Files, then pick it from there. The analysis runs in the phone's browser exactly as on a computer.

---
Tool by Maurizio Fonte, senior backend engineer. All tools: https://www.mauriziofonte.it/tools/