What Unmask checks

Every check, what it means, and how much it adds to the risk score. The numbers here match the code in extension/src/analyzers and extension/src/integrations.

• How the score works
• Sender authentication
• Sender identity
• Look-alike domains
• Links
• Attachments
• Body content
• Sender history
• Your protection list
• Payment fraud (BEC)
• QR codes
• Fake brand logos
• Privacy and tracking
• Online checks
• Warnings inside Gmail and Outlook

How the score works#

Every check is measured against a labelled corpus in extension/tests/fixtures/corpus: realistic phishing emails modelled on published write-ups (CEO gift cards, a DocuSign look-alike with a pre-filled login, PayPal invoice and Geek Squad callback scams, device-code phishing, ClickFix, a locked ZIP with its password, a forged Google stamp, an HTML login attachment, a fake reply changing bank details, a replayed Google alert) and legitimate emails built like the real thing (a personal reply, an Amazon order and a Chase fraud alert with phone numbers, a Google Docs share, a Microsoft security code, a mailing-list post that broke DKIM, newsletters with encoded tracking links). Every phishing sample must be rated High risk and read as the right kind of attack; every legitimate one must come out clear. Add a sample by dropping an .eml into phish/ or ham/.

Each finding has a severity and points:

The score is the sum of points, from 0 to 100:

• Reassuring findings can take off at most 15 points in total, so a passing DMARC check can't hide real problems.
• Reassurance takes off nothing once there is a high or critical finding. Passing DMARC, a verified signature or a sender you know proves who sent the email, not that it is safe: hacked accounts, replayed emails and attackers' own domains pass too.
• Any critical finding, or two high findings, forces at least 60, which means High risk.
• Verdict: 0–19 No red flags found · 20–49 Suspicious · 50–100 High risk.

Online checks (domain age, VirusTotal, urlscan.io) add their findings when they finish, and the score updates.

Source: core/score.ts.

Sender authentication#

Read from the Authentication-Results header that the receiving mail server (Gmail, Outlook, Yahoo, iCloud) added. Both Gmail and Outlook formats are supported. Source: analyzers/auth.ts.

Which Authentication-Results header is used: the first one written by the provider that delivered the email to you (matched against the trusted part of the delivery path), never one from a provider that isn't in the path.

Inside the DKIM signatures#

Unmask also reads every DKIM-Signature itself and recomputes its body hash on your computer (relaxed and simple canonicalization, SHA-256 and SHA-1, the l= length limit). Source: lib/dkim.ts, analyzers/dkim.ts.

With online checks on, Unmask also fetches each signer's public key and verifies the signature itself (RSA-SHA256, RSA-SHA1 and Ed25519), the same check your provider ran on arrival. A signature that passed on arrival but fails now is treated as a rotated key, not tampering. See Online checks. | This copy differs from what your provider verified | Note | 0 | Usually a pasted copy rather than the original |

DKIM replay#

A genuine signed email (often a notification the attacker triggered on their own account, with the lure in a field they control) re-sent unchanged to many people. The signature verifies and DMARC can pass, so it needs several signs together. Source: analyzers/replay.ts.

When it fires, the DMARC passed reassurance is removed.

Forwarding record (ARC)#

Forwarding servers that support ARC record the authentication results they saw and seal them (ARC-Seal, ARC-Message-Signature, ARC-Authentication-Results). Unmask reads the chain's structure and results; it does not verify the seals' signatures. Source: analyzers/arc.ts.

Delivery path#

The Received headers, read from the bottom up the way an analyst reads them. Lines written by your own mail provider are trusted; lines below the point where your provider took the email were written by servers you can't check, possibly the sender itself, and the Headers tab marks them can't be verified. Source: analyzers/received.ts.

Sender identity#

Source: analyzers/sender.ts.

Domain age (online, on by default; see Online checks): registered under 30 days ago High 25; under 6 months Medium 10; no registration record Medium 10; older is a note. Skipped for free webmail and known brands.

How the email was built#

Each mail service builds its emails its own way; scam tools build them differently. Source: analyzers/identity.ts.

Look-alike domains#

Source: analyzers/lookalike.ts, brand list in analyzers/brands.ts.

Unmask compares each domain against 50+ frequently impersonated brands (PayPal, Apple, Microsoft, Google, Amazon, Netflix, banks, couriers, crypto exchanges, Indian banks and services, and more), each with the domains it really uses. A brand's own domains never match.

How a domain is normalized before comparing:

• Unicode tricks are decoded (xn--pypal-4ve.com → pаypal.com).
• Look-alike characters become their Latin twins: Unicode's own confusables list (UTS #39, about 1,600 characters from Cyrillic, Greek, Coptic, Cherokee, mathematical and full-width letters), plus digits 0→o 1→l 3→e 5→s, and rn→m, vv→w. The table is generated by node scripts/gen-confusables.mjs confusables.txt.
• Accents are removed.

What counts as a match:

Links#

Every link in the HTML and the plain-text part. Source: analyzers/links.ts.

Unwrapping, done locally with no network requests: Google redirects, Microsoft Safe Links, Proofpoint URL Defense (v2 and v3), Facebook/Instagram link shims, YouTube and LinkedIn redirects, Slack redirects, and generic ?url=/?redirect= parameters.

Findings are grouped by type: the same problem on several links becomes one finding (+2 points per extra link, at most +8).

To avoid false alarms on normal newsletters:

• Links through known mailing services (SendGrid, Mailchimp, HubSpot, …) whose text shows another domain count as tracking (3), not mismatch (25).
• Redirects through the sender's own domain are not flagged.
• Ordinary .html pages are not "downloads".

Attachments#

Every attachment is hashed (SHA-256) on your computer. Source: analyzers/attachments.ts.

Looking inside (analyzers/documents.ts). Files are parsed as bytes; nothing is opened or run. Links found inside go through every link check and appear on the Links tab marked with the file they came from.

The attachment's worst flag sets its points (Critical 35, High 22, Medium 10, Low 4), plus 4 for each extra flag, at most 45 per file.

Body content#

Source: analyzers/content.ts.

Encoding tricks. Mail apps decode the HTML source before showing it; keyword and link filters often read the source. Phishers exploit the gap. Legitimate email tools encode punctuation (', ’,  ), never ordinary letters. Source: analyzers/obfuscation.ts.

Hidden text means elements styled display:none, visibility:hidden, fully transparent, a zero-size font, collapsed to zero height, or text coloured the same as its background. The Body tab's Show hidden text switch outlines it in red.

Phrases include "within 24 hours", "account has been suspended", "unusual sign-in", "final notice", "verify your account", "confirm your password", "update your payment information", "mailbox full", "gift card", "wire transfer" and more. Hovering these findings marks the words in the email.

Attack techniques#

Named techniques that analysts recognise by their shape rather than by a bad link or a failed check. Source: analyzers/techniques.ts.

Sender history#

Source: analyzers/history.ts. Unmask remembers, in this browser only, which addresses have emailed you, how often and since when. High-risk emails and emails opened from files are never learned. You can turn this off or forget everything in Settings → Privacy.

Fingerprints. For every sender, Unmask remembers how their emails are usually built: the DKIM signing domain, the mail service that handed them to your provider, the Message-ID domain, the mail program, and any Reply-To domain. Analysts compare a suspicious email with a known-good one from the same sender; this does it automatically, but only for traits that were consistent in at least 75% of earlier emails. Emails without real headers (Outlook's page view) are not used. Source: analyzers/fingerprint.ts.

First-contact warnings start once Unmask knows 10 senders, so a new install doesn't flag everyone.

Your protection list#

Source: analyzers/protection.ts. Only runs for entries you add in Settings.

What this looks like#

Source: core/assessment.ts. The Summary groups the red flags into the kind of attack they point to, the way an analyst writes up a case, with a confidence from the weight of the evidence (critical 3, high 2, medium 1, low ½; 3+ is high confidence, 2+ medium):

Forged sender address · Impersonation · Password phishing · Account access trick (consent and device-code) · Malware delivery · Callback scam · Payment fraud · Replayed genuine email · Possibly a hacked account.

It adds no points. Below it, What Unmask couldn't check lists the blind spots of this particular email: missing headers, DKIM signatures not verified with the signer's key, delivery steps written before your provider got the email, links checked by address only, files read but not run, and remote images not loaded.

Plain words#

Source: core/plain.ts. The plain-words card and banner sentence are built only from the findings above: the verdict picks the headline ("This email looks like a scam." / "Be careful with this email." / "Nothing looks wrong with this email."), and the most serious findings, one per problem, become up to three everyday reasons. They add no points of their own.

Payment fraud (BEC)#

Source: analyzers/bec.ts. Business email compromise needs no link or file, only a convincing request.

QR codes#

Source: analyzers/qr.ts. QR codes are decoded on your computer from image attachments, inline and embedded (data:) images, and images inside PDFs. Remote images are not downloaded.

Each decoded link is also put through every link check, so a QR code pointing at a look-alike domain gets that finding too.

Fake brand logos#

Source: analyzers/logos.ts. Flags an email that shows a brand's logo but wasn't sent from that brand's domain. Signals, none of which download anything:

• the image is loaded from the brand's own asset host (for example paypalobjects.com)
• its alt text, title or file name names the brand
• an embedded image's perceptual fingerprint (dHash) matches the brand's logo; fingerprints for 42 brands are generated from simple-icons by pnpm --filter unmask-extension logos

Logos that link to the brand itself (social icons, app-store badges) are ignored.

Privacy and tracking#

Source: analyzers/trackers.ts. These are privacy notes worth 0 points: tracking is normal for newsletters and isn't phishing.

• Tracking pixels: remote images 3×3 pixels or smaller, hidden or transparent images, images at tracking paths (/open, /wf/open, /pixel, …), and CSS background images from tracking addresses.
• Click-tracked links: links routed through a known tracking service.
• Where each pixel is: its number, image position ("image 2 of 2"), how far through the visible text it sits, the words just before and after it, whether it's inside a hidden block, its size and its full address. The Body tab's safe view tags each pixel's spot, and pixels are never loaded there, even when other remote images are. Source: analyzers/trackers.ts.
• Services recognized (~40): Mailchimp, SendGrid, HubSpot, Mailtrack, Mixmax, Yesware, Streak, Superhuman, Bananatag, ContactMonkey, Boomerang, Mailgun, SparkPost, Amazon SES, Postmark, Salesforce Marketing Cloud, Klaviyo, Campaign Monitor, Constant Contact, Customer.io, Intercom, Iterable, Braze, Mailjet, Brevo, Kit, Substack, beehiiv, MailerLite, GetResponse, ActiveCampaign, Marketo, Oracle Eloqua, Zoho Campaigns, Omnisend, Drip, Google Analytics, Google Ads, Meta Pixel, LinkedIn Ads.

Online checks#

These run only when you click them, except domain age and domain intelligence, which run automatically and can be turned off in Settings.

Well-known brands and webmail providers are skipped for the automatic lookups.

Warnings inside Gmail and Outlook#

Source: lib/gmailProtect.ts, lib/protect.ts. Each can be turned off in Settings → Protection inside Gmail.

• Banner above emails rated Suspicious or High risk, with the top three reasons.
• Inbox badges next to risky senders: from the verdict of a conversation you already opened, or a quick check of the sender line (display-name tricks, look-alike domains, brand claims, sender history).
• "Wait, this link goes to …" before a link opens when the link has a High/Critical flag, has a Medium flag in a suspicious email, or leaves the sender's domain in a high-risk email.
• Reply warning when Reply would send your answer to an address on another domain.
• Peek (Gmail): a button on each inbox row downloads that email's source and runs every check above without opening it, showing a text-only preview. Optionally, up to 15 unread rows per list are checked automatically.

In Outlook on the web Unmask reads the email from the page, because Outlook doesn't give pages the original source. Header checks (SPF, DKIM, DMARC, delivery path) need … → View → View message source pasted into the panel.