Not sure about an email? Forward it. We will check it.
Send any email you are unsure about to the address below. Minutes later, a clear
assessment lands in your inbox: is it safe, is it a scam, and exactly why. No account,
no signup, no cost.
Forward any suspicious email to this address. No account needed.
What happens to your email
The moment it arrives, your email begins its journey down the pipeline.
Every stage examines it, then hands it to the next.
You forward it
Send any suspicious email to our reporting address. No account, no signup, nothing to install.
We take it apart
Headers, the real sender, every link, attachments and any QR codes, separated out and examined one by one.
We prove who really sent it
Authentication checks (SPF, DKIM, DMARC), lookalike domains, and senders pretending to be a brand or a colleague.
We follow every link, so you never click
Each link is opened in a sealed sandbox. We even read the page it lands on, to catch a fake sign-in trap in the act.
We check it against the whole network
Every report every business has ever made. If this sender has caught someone else out, we already know.
You get a clear verdict
A real, evidence-based assessment lands in your inbox. Three separate scores, never collapsed into one number.
EXAMPLE ASSESSMENT
RISK
78/100
CONFIDENCE
91%
NETWORK
CORROBORATED
Then your email is deleted
We keep the assessment, not your email. Once the checks are finished, the raw
email you forwarded is permanently removed. Sender Registry is an intelligence
network, not an inbox.
Free, and no account
Forward from any inbox. Nothing to install, nothing to sign up for, nothing to pay.
You never click a thing
We open and read the dangerous links so you do not have to. The risk stays with us.
A real, plain answer
Not just a score. A plain-English verdict with the evidence behind it, so you know what to do next.
Every object in the registry (a sender, a domain, a campaign) moves through five
stages as independent evidence builds:
UNSEENNothing reported yet.
OBSERVEDOne report exists. A single data point, not yet corroborated.
CORROBORATEDA second, independent organisation has reported the same thing.
NETWORK CONFIRMEDFive or more independent organisations agree.
VERIFIEDTen or more independent organisations, the strongest confidence level.
This is deliberately separate from Risk and Confidence. How much of the network agrees
is a different question from how dangerous something looks, or how certain we are.
How Threat DNA works
Every campaign gets scored across 8 axes: infrastructure, domain patterns, message
templates, link behaviour, attachment patterns, target industries, target roles, and
campaign velocity. All plotted as a fingerprint.
Sender Registry compares every campaign's fingerprint against every other campaign's
using cosine similarity: the same technique used to compare documents by meaning, not
just matching words. A high match (we only ever suggest one above 55% similarity) means
two campaigns that look unrelated on the surface may share real infrastructure, even
under completely different domain names.
How the Intelligence Map works
Senders, domains, URLs, attachments, campaigns, brands and suppliers all become nodes
in a shared relationship graph, built from real evidence: a sender using a domain, a
domain appearing in the same report as another domain, a report belonging to a campaign.
On a phone, we deliberately don't force a giant graph onto a small screen. Instead you
get a focused view: the object you're looking at, and everything directly connected to
it, with a tap to move to any of those connections in turn.
How push notifications work
Add Sender Registry to your home screen and turn on notifications from your account -
both free, both take under a minute. From then on, anything urgent (a payment-diversion
campaign, an executive impersonation attempt) reaches you as a real notification on your
lock screen, the same way any other app alerts you.
Every notification is sent end-to-end encrypted directly to your device - nothing is
readable in transit by anyone other than your phone.
How the QR scanner works
Open Verify Before You Act, point your camera at a QR code, and capture it. The image is
decoded and the destination it leads to is checked exactly the same way we already check
a QR code found inside a forwarded email - the same detection, just with your camera as
the front door.
You'll see whether the destination is safe, blocked, or worth a second look, with a plain
explanation either way.
How sharing to Sender Registry works
On Android, once the app is added to your home screen, "Sender Registry" simply appears
as an option in your phone's normal Share menu - the same one you'd use to send a photo
to a friend. Share a suspicious text or link straight in, review it, and submit.
On iPhone, Apple's own software doesn't allow a website to appear in the Share menu
automatically. A short, one-time setup (a free "Shortcut") gets you the same result -
after that one step, it behaves identically on both phones.
Sender Registry