Drop the saved message or the attachment that worries you. The tool takes it apart in your browser without opening it and tells you what it would try to do: run a macro, fetch a program, send you to a page dressed up as your bank. It is not an antivirus, and it will never tell you a file is harmless.
The file is read and taken apart in your browser and is never uploaded. Only the domain names found in it go to the server, to look up their age and reputation. What leaves your device
In Gmail open the email, three-dot menu, Download message: you get an .eml file. In Outlook drag the email to the desktop (an .msg file) or save just the attachment.
Or tap the box to pick the file on your phone. The analysis starts by itself and takes a few seconds; the file stays on your device.
At the top you get one of four outcomes, then the list of what the file would do, worst first, and a table of the domains it mentions.
Copy the report or download the JSON for your IT person. The technical detail shows every part of the file and the rule behind every finding.
A dangerous document does nothing until you open it with the right program: Word runs the macro, the PDF reader runs the JavaScript, Windows follows the shortcut. This tool uses none of those programs. It reads the file as a sequence of bytes, rebuilds its structure (the ZIP inside the .docx, the VBA project inside the .xlsm, the objects inside the PDF, the attachments inside the email) and lists the parts able to act on their own.
An antivirus compares the file with signatures of attacks it has already seen, and last night's attack often has no signature yet. The reasoning here is different: look for capabilities a document should not have. A macro that runs on opening and starts PowerShell, a Word template fetched from an unknown server, a PDF where one link covers the whole page. These techniques change far more slowly than individual attacks, and you can spot them without knowing who used them.
Since 2022 Office blocks macros in files downloaded from the internet, so attackers moved on: archives with scripts inside, disk images, .lnk shortcuts, HTML pages that assemble a file in the browser, PDFs that lead to a fake login. That is why the tool also reads the email around the attachment: who sent it, where replies go, where the links really point and how many days the domains have existed.
The outcome at the top is one of four, and none of the four means the file can be opened without a second thought.
Each finding has a severity (critical, high, medium, low) and a sentence saying what would happen if you opened the file. The technical detail, closed by default, shows the position in the file, the extracted facts, the rule and the MITRE ATT&CK reference, so an IT person can check everything again.
It is not an antivirus. Keep your mail filtering and endpoint protection: this tool works next to them. It never runs the file, so it cannot see what a program would do only under certain conditions, and it does not recognize an exploit written for a specific Word or PDF reader bug that leaves none of the marks we know.
RAR and 7z archives can only be listed, and archives locked with a password stay locked. An attacker who knows the rules can try to build a file that avoids them: a limit of every public check that does not execute anything.
So an outcome without findings is not a green light. The strongest defense is still the oldest one: if an email you did not expect asks you to open an attachment or type a password, check with the sender through a channel other than email.
Your file stays in the browser. A browser component (a web worker) reads it into memory and takes it apart, and that component is forbidden any network connection: even if it wanted to, it could not send anything. When the analysis ends that component is shut down and the file is not stored anywhere.
Because of how the site works, these things do leave your device:
poste-it-verifica.example), which our server checks against phishing lists and whose registration date it asks the public domain registries for (RDAP, and whois for .it). The rest of the address, the file and its contents stay with you;If the email holds data you do not want to show anyone, save just the attachment and analyze that.
In Italy, companies and professionals exchange invoices and formal notices through PEC, a certified email service. A PEC certifies who sent a message and when it was delivered; it says nothing about whether the content is harmless, and hijacked PEC mailboxes are used to send malicious attachments to people who trust a message because it arrived by PEC.
When you drop a PEC envelope (the .eml file downloaded from the provider's webmail), the tool recognizes the provider's envelope, opens the original message postacert.eml and analyzes its attachments. Digitally signed .p7m files, including Italian e-invoices in .xml.p7m, are opened too: the signed document is extracted and analyzed.
Technical terms used on this page, briefly explained.
Laws, official tables and reference implementations the logic of this tool was checked against.
If emails like this keep arriving and you do not know whether someone already opened one, I can review the mail setup, the filters and the machines involved, and tell you what to fix. Tell me what happened.
Write to me