Under the hood
How It Works
Pick how deep to look. Drop an email file. Get a verdict in anywhere from 8 to 90 seconds, depending on the depth you chose.
Here's exactly what happens, and what we never do.
You choose a scan depth
Every scan runs at one of three depths, which changes the AI model doing the reasoning and how much external checking happens. Standard is selected by default, so you can ignore this entirely and just drop a file. Each depth has its own allowance, so spending your deep scans never eats into your quick ones.
Light · about 8 seconds · 10 per day
Fast triage. Full header, authentication, and sender-identity analysis, plus domain reputation, registration age, and Google Safe Browsing. Skips the live browser sandbox, which is the slow part. Best when you want a quick read on something mildly suspicious.
Standard · about 45 seconds · 5 per day · default
Everything in Light, plus a real headless browser loads the main link and follows every redirect to see where it actually goes. This is the right choice for almost everything.
Ultra · a minute or two · 1 per day
Our most capable model at maximum reasoning depth. Scans two links instead of one, visually inspects a screenshot of the destination page, and shows you its actual reasoning. Also classifies the attack type, lists the evidence that argues against its own verdict, judges whether you were specifically targeted, and names the one check that would settle an uncertain call.
You drop an .eml file
Export any suspicious email from Gmail, Outlook, Apple Mail, or Thunderbird as an .eml file and drop it on the scan page. MailArgus validates the file before anything leaves your device. Wrong format or over 5 MB is rejected immediately.
We parse the email & identify the key link
The file is parsed entirely in server memory: sender identity, SPF/DKIM/DMARC authentication, the full mail server routing chain, body text, all URLs, and attachment hashes. Then Claude Haiku reads the link list and identifies the 1–3 most likely call-to-action URLs (e.g. "Verify your account") so you can confirm which link to scan before anything is submitted to external services. The raw file is never written to disk or stored.
Threat intel checks run in parallel
Once you confirm the link, every enrichment check fires concurrently so nothing blocks anything else. These four query external services:
urlscan.io
A real headless browser loads the link, follows all redirects, and captures the final destination, domain, IP, and any phishing infrastructure. Submitted as unlisted. Your scan never appears in public results. Standard scans one link, Ultra scans two in parallel, and Light skips this step because the sandbox is what makes a scan slow.
VirusTotal · Domain
The final destination domain (after all redirects) is checked against VirusTotal's 90+ security vendor database. Catches malicious domains even when the original link looks innocent.
VirusTotal · Attachments
SHA-256 hashes of any attachments are checked against 90+ antivirus engines. No file bytes are ever transmitted. Only the hash.
Google Safe Browsing
The final destination URL is checked directly against Google's Safe Browsing API, the same database Chrome uses to warn users about dangerous sites.
Three more checks run entirely on our own server with no external API involved. They cost nothing and have no rate limit, so they run at every depth, including Light:
Look-alike and homoglyph detection
Catches domains built to be misread: paypa1.com with a digit one, Cyrillic characters that render as Latin letters, punycode addresses, and names a character or two away from a known brand. It also checks the sender's display name, which is how "PayPaI Support" slips through with a capital I while the actual address looks unrelated and clean.
Published DNS policy
We look up what the sender's domain actually publishes: its SPF record, its DMARC policy, and whether it has mail servers at all. This is what gives an authentication pass its meaning. A pass on a domain that publishes no DMARC policy is far weaker evidence than a pass on one that tells the world to reject anything unsigned.
Domain registration records
A public registry lookup for when the domain was registered and by which registrar. Freshly registered domains are a hallmark of phishing infrastructure, and a domain created days ago claiming to be your bank is one of the strongest single signals there is.
Claude reasons over every signal
All extracted signals (headers, authentication, routing, body, URLs, and every threat intel result) are passed to Claude. The depth you picked decides which model: Haiku for Light, Sonnet for Standard, and Opus at maximum reasoning depth for Ultra. Claude weighs signals in priority order: authentication failures first, then sender identity spoofing, then external URL and domain verdicts, then content signals like urgency language. A Phishing verdict requires at least two corroborating signals. Claude won't flag a legitimate email on urgency language alone.
Because Light has no live sandbox result to reason about, it uses a different bar for what counts as corroboration rather than the same one applied to a smaller pile of evidence. It also leans toward Suspicious where a deeper scan would have settled the question, and its confidence is capped to reflect that it looked at less. A fast scan should say so, not pretend to certainty it hasn't earned.
You get a verdict
Results come back as one of three verdicts with a plain-language summary, key findings, and immediate advice. The Stats for Nerds panel shows the full technical breakdown: authentication badges, urlscan report, VirusTotal domain and attachment results, Google Safe Browsing status, signal-by-signal analysis, and AI confidence. Every result is labelled with the depth that produced it, so a quick scan is never mistaken for a thorough one. You can also generate a 7-day share link to send the result to someone else. Email body content is never included in shared links.
Ultra results carry extra sections: the attack type, a list of evidence that argues against the verdict it just gave you, an assessment of whether the email was aimed at you specifically or blasted at everyone, and on an uncertain call, the single concrete check that would resolve it. An Analyst Reasoning panel shows the model's own reasoning trace where it produced one.
Safe
No meaningful red flags. Authentication passes, sender checks out, no malicious URLs, domain, or attachments.
Suspicious
Something is off but evidence is incomplete. One strong signal without corroboration. Treat with caution and verify through official channels.
Phishing
Strong corroborating evidence of malicious intent. Multiple signals confirm it. Do not click any links. Delete immediately.
What we never do
Your email file is processed in memory and discarded. No email content, addresses, or URLs are logged. Your IP is HMAC-hashed before rate-limit storage. The raw IP is never saved. Attachments never leave our server as bytes. Only their SHA-256 hash is sent to VirusTotal. External scans use unlisted visibility. We store no accounts and no email data. Ever.
MailArgus is a research tool. AI-generated verdicts may be incorrect. Always apply your own judgment. Not a substitute for professional security advice.
