How to check a suspicious email
Paste the From line if you have it, then the body (and headers if they are handy). Press Check for red flags. The checker looks for urgency, password or billing requests, gift-card and crypto asks, shortened or IP-based links, brand names that do not match the sending domain, and similar tells. Then confirm the address itself with the email address validator and see who hosts the domain with the email host lookup.
Worked example
A typical phishing mail looks like this invented sample:
From: PayPal Support <[email protected]> Subject: Your account will be closed Your PayPal account will be closed. Click http://bit.ly/not-a-real-link to verify your password immediately.
On that text the checker should flag the urgent closure threat, the request to verify a password, the link shortener, and the lookalike sender domain (paypa1 rather than paypal). The details are an example, not a live scan of a real inbox. For the raw path a real message took, paste its headers into the email header analyzer.
What this checker cannot do
It cannot open links for you, inspect attachments, or talk to the sending server. It does not replace your provider's spam folder. If you want the domain's mail servers, use the MX lookup. If you only needed a safe place to receive a code from a site you do not trust yet, open a temp inbox instead of using your real address.
Questions
Does a high score mean the email is a scam?
No. It means several common red flags matched. People send blunt, urgent or poorly formatted mail for honest reasons too. Treat the result as a prompt to slow down: open the real site yourself, call a published number, and do not use the links in the message until you are sure.
What text should I paste?
The sender (From) line plus the visible body is enough. Headers help if they are included, especially Reply-To. You do not need to paste your password or one-time codes; those belong nowhere in a public form.
Is the text I paste stored?
The text and sender are sent to Volt Ghost so we can score them. We do not keep the message. We may keep short abuse logs (time, IP, and why a request was refused) to enforce rate limits. Do not paste secrets.
How is this different from the header analyzer?
The header analyzer runs in your browser and explains hops plus the SPF, DKIM and DMARC results your provider already recorded. This checker looks at wording, links and the sender for phishing patterns, and the scoring rules stay on our servers.