Suspicious Email Detector
Analyze emails for phishing, scam indicators, and security threats
That email from 'your bank' looks almost real but something feels off — and one wrong click could compromise your entire organization. This playbook analyzes emails for phishing indicators, scam patterns, spoofed sender details, and social engineering tactics with a clear threat assessment.
Who it's for: IT security teams building first-response email threat analysis workflows, employees who receive suspicious emails and need quick risk assessment, small business owners without dedicated security staff who need phishing detection, security awareness trainers creating phishing analysis examples for employee education, office managers responsible for flagging suspicious communications to the team
Example
"Check if this email from 'IT Support' requesting password reset is legitimate" → Email analysis pipeline: sender header inspection (SPF, DKIM, display name vs actual address), URL analysis checking for domain spoofing and redirect chains, language pattern detection for urgency manipulation and social engineering, comparison against known phishing templates, and threat assessment score with recommended action (safe, suspicious, dangerous)
CLAUDE.md Template
New here? 3-minute setup guide → | Already set up? Copy the template below.
npx ccplaybooks add suspicious-email# Suspicious Email Analyzer
Analyze emails for phishing attempts, scams, and security threats to protect against fraud.
## Overview
This workflow helps you:
- Identify phishing attempts
- Detect scam patterns
- Analyze suspicious links
- Assess email authenticity
- Recommend safe actionsGet new playbooks like this one
One email a week with new Claude Code workflows. Free, like everything here.
No spam. Unsubscribe anytime.
What This Does
Analyze emails for phishing attempts, scams, and security threats to protect against fraud.
Quick Start
Step 1: Create a Project Folder
mkdir -p ~/Documents/SuspiciousEmail
Step 2: Download the Template
Click Download above, then:
mv ~/Downloads/CLAUDE.md ~/Documents/SuspiciousEmail/
Step 3: Start Working
cd ~/Documents/SuspiciousEmail
claude
How to Use
Analyze an Email
Provide Email Content
Include:
- Sender email address
- Subject line
- Full email body
- Any links (don't click them!)
Limitations
- Cannot access actual email headers without them being provided
- Cannot verify real-time domain reputation
- Cannot click or analyze live links
- Some sophisticated phishing may pass analysis
- Legitimate emails may have some warning signs
- Human judgment is essential for final decision