Sender Registry
What happens when you forward an email
One email arrives at our address. Before the assessment reaches you, it has been taken apart, authenticated, followed link by link, read for the language of fraud, and checked against every report the network holds. Here is the whole journey.
Just want to check one email? Start here →
The journey, top to bottom
Follow one email as it flows down through the pipeline. Each gate examines it, then passes it on.
You forward it
Send any suspicious email to our reporting address. No account, no signup, nothing to install.
We take it apart
Headers, the real sender, every link, all attachments and any QR codes, separated out and examined one by one.
We prove who really sent it
Authentication (SPF, DKIM, DMARC) and whether the reply address matches, so a forged sender is caught at the door.
We hunt for impersonation
Lookalike domains, senders posing as a well-known brand, and colleague or executive impersonation used in invoice fraud.
We follow every link, safely
Each link is opened in a sealed sandbox and followed through its redirects. We read the page it lands on to spot a fake sign-in trap.
We open attachments and QR codes
Dangerous file types are flagged, and any QR code is decoded and its destination followed, exactly like a link.
We read it like a person
Sender Registry reads the wording for the tells of fraud: false urgency, a change of bank details, a payment request, a hijacked thread.
We check it against the network
Every report every business has ever made. A brand-new campaign is recognised across the network, not one victim at a time.
You get a clear verdict
A real, evidence-based assessment lands in your inbox. Three separate scores, never collapsed into one number.
Every check we run
The pipeline above is the shape of it. Underneath, more than forty individual checks run across nine areas.
Who really sent it
- ✓SPF, DKIM and DMARC authentication
- ✓Reply-To address consistency
- ✓Forged and spoofed sender detection
Impersonation
- ✓Brand impersonation, a sender claiming to be a company it is not
- ✓Executive and colleague impersonation used in invoice fraud
- ✓Lookalike and cousin domains
Sender reputation
- ✓Domain age, brand new versus long established
- ✓Senders the network has already confirmed malicious
- ✓Disposable throwaway domains and risky top-level domains
Links, followed safely
- ✓Every link opened in a sealed sandbox, so you never click
- ✓Redirect chains unwound to the real destination
- ✓Known-malicious link and fake sign-in page detection
Attachments and QR codes
- ✓Dangerous file types: programs, macro documents, double extensions
- ✓Files already reported malicious elsewhere in the network
- ✓QR codes decoded and their destination checked like a link
The words themselves
- ✓Sender Registry reads the message for the language of fraud
- ✓False urgency, payment requests, a change of bank details
- ✓A genuine conversation being hijacked mid-thread
The shared network
- ✓Checked against every report every business has made
- ✓A new campaign recognised across the network at once
- ✓Retrospective matching as fresh reports come in
What kind of mail it is
- ✓Personal, a receipt, marketing, cold outreach or spam
- ✓A second axis, kept separate from how dangerous it is
- ✓So genuine bulk mail is never mistaken for an attack
The verdict you get back
Three separate answers, never squeezed into one number. Each one tells you something the others cannot.
How dangerous is this?
A score from 0 to 100, and a plain band from Low to Critical, with the evidence that drove it.
How sure are we?
A brand-new sender gives us less to work with than one seen a hundred times. We show you that, rather than hide it.
Has anyone else seen it?
From Unseen through to Verified. Not seen before is never the same as safe, and we say so plainly.
A high-risk email nobody has seen before, and a high-risk email fifty businesses have reported, are different situations. You deserve to tell them apart, so we never collapse the three into one figure.
Then it is over to you
Every one of these comes with your assessment, free, on a forwarded email.
Block the sender
Step-by-step instructions written for your exact email app, so blocking takes seconds.
Unsubscribe safely
Where it is genuine bulk mail and safe to do so, we can unsubscribe you without you touching a risky link.
Report it onward
With your consent, we forward a genuine threat to the national reporting service for your country.
Tell us if we got it wrong
Your feedback is ground truth. It sharpens the assessment for you and for everyone on the network.
Then your email is deleted
We keep the assessment, not your email. Once the checks are finished, the raw email you forwarded is permanently removed. What we hold on to is the intelligence that protects the next business, never your inbox.
Try it on a real email
Forward one you are unsure about and see the whole pipeline work for you.