Identity and impersonation
Compares From, Reply-To, Return-Path and sending domains, then checks verified brand families, lookalike domains, confusable characters, machine generated infrastructure and a 1,000+ identity watchlist.
PHISHING EMAIL ANALYSERFrom suspicious email to a clearer next step.
Jatzo examines sender identity, authentication, links, message intent and social engineering signals, then explains what changed the risk score.
- From
- Microsoft 365 <account-security@micros0ft-account.example>
- Subject
- Unusual sign-in activity on your account
Email risk score
91/100
Risk gradeVery high risk
Multiple strong indicators suggest this email may be phishing or malicious. Do not click links, open unexpected attachments, or provide sensitive information until independently verified.
What it wantsGet you to sign in or reveal account access
Top reasons for this score
- +22Possible brand impersonation
A known brand's name from a domain it does not use, with signs of disguise, is impersonation.
- +18An impersonated brand warns about your account
A fake warning about your account from a brand that did not send it is how account takeover starts.
- +10Account security alert lure
Alarm about your account is used to rush you into signing in on a copied page.
and 6 more findings in the full result
Recommended action
Do not use the supplied sign-in path. Open the real service independently and check your account there.
Check. Understand. Act.
- 01
Check
Paste it, or check in Outlook.
- 02
Understand
A grade, reasons and evidence.
- 03
Act
Your next step, in plain English.
What Jatzo reads in a suspicious email.
Sender identity
Compare From, Reply-To, Return-Path and display-name evidence.
Authentication
Surface SPF, DKIM and DMARC evidence supplied with the message.
Social engineering
Look for credential requests, payment pressure, urgency, impersonation and reward tactics.
QR codes, wherever they hide
Read codes in attached and inline pictures, on the first three pages of a PDF and in the pictures inside Word, Excel and PowerPoint files, and check where each one leads like any link.
Attachments, never opened
Inspect file types, archives, macros and active PDF content inside an isolated container, without running anything.
Explainable result
See a clear risk grade with the signals that contributed to it.
Every point on the score has a reason.
+22 points
Possible brand impersonation
ObservedThe display identity invokes Microsoft, but the From address uses micros0ft-account.example.
Why it mattersA known brand's name from a domain it does not use, with signs of disguise, is impersonation.
+18 points
An impersonated brand warns about your account
ObservedThe message poses as a well known organisation from a domain that organisation does not use, and warns about your account: a withdrawal, a change to your details or a sign-in from somewhere new.
Why it mattersA fake warning about your account from a brand that did not send it is how account takeover starts.
+10 points
Account security alert lure
ObservedThe message uses an unusual-login, password, mailbox or MFA warning to prompt an account action.
Why it mattersAlarm about your account is used to rush you into signing in on a copied page.
Every score tells a story.
Real Jatzo output for three fictional messages, not a live check of your mail.
FICTIONAL EMAIL
Updated bank details for invoice 4471
- From
- Pellowmere Supplies <accounts@pellowmere-billing.example>
- Reply-To
- payments@pellowmere-accounts.example
- Your provider checked
- SPF: fail for pellowmere-billing.example (the envelope sender)DKIM: noneDMARC: fail for pellowmere-billing.example (the From domain)
Hello Alex,
Our bank details have changed. Please pay invoice 4471 to our new account today to avoid a late payment fee, and update your records for future payments.
View the invoice and the new details: https://pellowmere-invoices.example/view/4471
Please confirm once the payment has been sent.
Kind regards, Accounts team
Email risk score
100/100
Risk gradeVery high risk
Multiple strong indicators suggest this email may be phishing or malicious. Do not click links, open unexpected attachments, or provide sensitive information until independently verified.
What it wantsGet you to send money or change payment details
Top reasons for this score
Select a reason to see where it is in the email.
ObservedThe message changes where money should be paid and also routes replies to another domain, steers you away from a phone call, or presses you to stop using the old account.
Why it mattersA bank change with replies routed elsewhere or a phone call discouraged is how a hijacked mailbox diverts money.
ObservedSupplied headers report DMARC failure.
Why it mattersThe domain in the From line did not authorise this message.
ObservedThe message appears to change supplier, beneficiary or remittance details.
Why it mattersA change to supplier bank details is the main step in invoice fraud.
ObservedAvailable headers report an SPF failure or soft failure.
Why it mattersThe server that sent this is not one the domain allows to send its mail.
ObservedFrom uses pellowmere-billing.example, while Reply-To uses pellowmere-accounts.example.
Why it mattersYour reply would go to a different domain from the one you see.
ObservedA result in this message reports DKIM=none, but Jatzo could not verify it.
Why it mattersWithout a signature nothing shows the message is unaltered or really from this domain.
ObservedThe message combines invoice, statement or remittance language with payment pressure and an attachment or destination.
Why it mattersPressure to pay an invoice quickly is how payment fraud gets past normal checks.
Recommended action
Do not send money or change payment details from this email alone. Verify the request using a trusted contact method you already have.
FICTIONAL EMAIL
Unusual sign-in activity on your account
- From
- Microsoft 365 <account-security@micros0ft-account.example>
- Your provider checked
- SPF: pass for micros0ft-account.example (the envelope sender)DKIM: noneDMARC: none for micros0ft-account.example (the From domain)
Microsoft account
Unusual sign-in activity
We detected something unusual about a recent sign-in to the Microsoft account alex@yourfirm.example. To keep your account safe, sign in and review your recent activity within 24 hours, or your account will be locked.
Review recent activity: https://micros0ft-account.example/verify
Thanks, The Microsoft account team
Email risk score
91/100
Risk gradeVery high risk
Multiple strong indicators suggest this email may be phishing or malicious. Do not click links, open unexpected attachments, or provide sensitive information until independently verified.
What it wantsGet you to sign in or reveal account access
Top reasons for this score
Select a reason to see where it is in the email.
ObservedThe display identity invokes Microsoft, but the From address uses micros0ft-account.example.
Why it mattersA known brand's name from a domain it does not use, with signs of disguise, is impersonation.
ObservedThe message poses as a well known organisation from a domain that organisation does not use, and warns about your account: a withdrawal, a change to your details or a sign-in from somewhere new.
Why it mattersA fake warning about your account from a brand that did not send it is how account takeover starts.
ObservedThe message uses an unusual-login, password, mailbox or MFA warning to prompt an account action.
Why it mattersAlarm about your account is used to rush you into signing in on a copied page.
ObservedThe email threatens account closure, legal action or another consequence.
Why it mattersThreats of closure or legal action are used to rush a decision.
ObservedA result in this message reports DKIM=none, but Jatzo could not verify it.
Why it mattersWithout a signature nothing shows the message is unaltered or really from this domain.
ObservedA result in this message reports DMARC=none, but Jatzo could not verify it.
Why it mattersWithout it, nothing stops someone else using this From domain.
ObservedThe message uses urgency or pressure to encourage immediate action.
Why it mattersTime pressure is used to stop people checking before they act.
ObservedThe message mentions authentication information in the context of an action or request.
Why it mattersTalk of passwords or sign-in beside a request is how credential theft starts.
Observedmicros0ft-account.example/verify: URL contains a sensitive action keyword; Destination shares the sender's registered domain (micros0ft-account.example); Domain resembles Microsoft (microsoft.com) but is a different registered domain
Why it mattersSomething about the link is unusual enough to check before clicking.
Recommended action
Do not use the supplied sign-in path. Open the real service independently and check your account there.
FICTIONAL EMAIL
Notes from Tuesday's planning meeting
- From
- Sam Patel <sam.patel@yourfirm.example>
- Your provider checked
- SPF: pass for yourfirm.example (the envelope sender)DKIM: pass for yourfirm.example (the signing domain)DMARC: pass for yourfirm.example (the From domain)
Hi Alex,
Thanks for joining on Tuesday. I have put the notes in the shared folder under Planning, and the next meeting is on the 6th at ten.
Could you bring the figures for the second quarter? No rush before then.
Thanks, Sam
Email risk score
1/100
Risk gradeLow risk
The available checks did not find significant phishing indicators. This does not guarantee the email is safe.
What was checked
Select a line to see where it is in the email.
Recommended action
Treat unexpected links, attachments and requests cautiously and verify the sender independently before acting.
A low score is not a guarantee that an email is safe. Automated analysis can be wrong, and missing evidence is not proof of safety, so verify important requests through a route you trust.
What a result cannot tell you.
- A low score is not a guarantee.
- Missing evidence is not proof of safety.
- Automated analysis can be wrong.
- Verify requests through a route you trust.
The phishing that is hard to spot is the phishing that passes every check
Most advice tells you to look for bad spelling and a strange address. The messages that actually cost people money do not have either. They come from a real company's real mailbox, after somebody there was compromised, and they authenticate correctly because they genuinely were sent by that domain.
That is why Jatzo reads a provider's accusation as evidence and ignores a clean claim. Anyone can write a header saying a message passed its checks. Nobody can make your own mail provider accuse a message it delivered without reason.
So the question is never only whether the sender is who they say. It is whether this message, from this sender, at this moment, is asking for something that deserves a second look before you act.
What actually deserves attentionA QR code hides its link from anything that only reads text
A code in an email is a link nobody can hover over, and the phone that scans it is outside whatever protects the inbox. Codes are usually sent inside an attached PDF or document, where anything that only reads the words of a message never sees them.
Jatzo reads them where they are: in pictures attached to the message or shown in it, on the first three pages of a PDF, drawn as pictures, and in the pictures inside Word, Excel and PowerPoint files. It never opens where a code leads. It tells you the destination, checks it like any link, and says plainly when a code is the only way the message gives you to act, which is how this kind of attack is usually built.
It says what it could not read. PDF pages after the third, older .doc, .xls and .ppt files, and vector pictures such as EMF are not read, and a document with more pictures than Jatzo reads is marked as not fully checked. A code Jatzo could not read is not the same as a code that is safe.
Which plans read QR codesFOR THE TECHNICAL READER
Authentication, identity and destination evidence.
172 registered checks across 8 kinds of evidence. Every one is declared with a category and a channel before it can score a point, so nothing counts towards a verdict that was not written down first.
Intent and threat patterns
Identifies what the message is trying to achieve, including credential theft, payment diversion, business email compromise, extortion, delivery lures, fake support and device code abuse.
Links and attachments
Separates real destinations from tracking noise and statically profiles supported files for extension mismatches, archives, document activity, HTML smuggling and embedded URLs, without ever executing an attachment.
Authentication evidence
SPF, DKIM and DMARC results are read as reported claims, not proof. A reported pass cannot cancel independent warning signs, and a check that could not run is recorded as uncertainty rather than safety.
Scoring you can audit
Every point on the score traces back to a named finding. Overlapping detections are grouped so they cannot simply inflate the total, and unwanted mail is scored separately from dangerous mail.
Campaign context
Related reports can be connected through keyed sender, subject pattern and destination fingerprints inside your own account or business workspace, without exposing anyone else's message.
Where it came from
The route, not just the address. Forward-confirmed reverse DNS, whether the receiving host resolves to the source IP and back again, and whether that address has any relationship with the domain the message claims. When the delivery route cannot be read, that is recorded as something unchecked rather than something passed.
What it will not do
Evidence sits on three channels: 147 checks carry threat evidence, 20 carry nuisance and 5 score nothing either way. A message without enough threat evidence stays below the phishing band however much nuisance it gathers, and a provider vouching for a message reduces what supporting findings are charged without ever dropping a real threat below that line.
Mapped, including where it is not
140 of the checks carry a MITRE ATT&CK reference, reaching 30 techniques across 9 tactics. 32 carry none on purpose, and the reason for each is published rather than rounded away, because a coverage figure with nothing under it is worth less than one you can argue with.
Every rule, placed in MITRE ATT&CK
No automated email security tool can guarantee a correct verdict. Jatzo keeps each signal explainable and treats weaker identity clues as supporting context rather than proof.
Start with five free checks each month.
See the analysis before deciding whether you need a paid plan.
Clear guidance for you. Detailed evidence for your experts.
You should not need an IT background to check a worrying email. Jatzo explains the warning signs and your next step in everyday language, whether you are at home, running a business or working in a team.
Understand what to do
Start with the risk rating, why it matters and what to verify before you click, reply or pay.
Investigate when you need to
Explore the available header, link and attachment evidence, with source-network details and live reputation on the relevant plans. Expert detail stays alongside the explanation.
A decision aid for people and their IT teams. Jatzo cannot guarantee that a message is safe.