unmask-phishing-inspector by Praneeth

Unmask checks the email you open in Gmail or Outlook on the web and tells you, in plain words, whether it looks like phishing.

• Warnings inside your inbox. A red or amber banner above risky emails and a badge next to risky senders, without opening anything.
• Stops risky clicks. "Wait, this goes to paypa1-secure.top" before a dangerous link opens, and a warning when Reply would go to a different address.
• First-contact warnings. Unmask remembers, only on your device, who normally emails you: "You've never received mail from paypa1-support.xyz. Your PayPal emails usually come from paypal.com."
• QR-code phishing. Reads QR codes in images and PDFs and checks where they really go.
• Payment fraud. Flags changed bank details, payment and gift-card requests, and a contact's name used from another address.
• Inside attachments. Links hidden in PDFs, macros in Office files, the file list of ZIPs, and a safe preview of HTML files.
• Fake logos. Spots an email showing PayPal's logo that PayPal didn't send.
• Domain checks. Brand-new domains, brand-new TLS certificates and missing mail records.
• Report it. One click to Gmail's Report phishing, APWG, Netcraft, Google Safe Browsing or PhishTank, plus a PDF or JSON report for your IT team.

Every check runs in your browser. Unmask has no server and no account. Optional lookups send only a domain name or a file fingerprint, and you can turn each one off.