Try a sample
Paste an email or pick a sample to see its risk score.
Reply-To and Return-Path pointing elsewhere, brand names in the sender name, look-alike sender domains, failed SPF / DKIM / DMARC.
Link text that shows one address but opens another, IP-address links, URL shorteners, punycode and look-alike brand domains, risky domain endings, @ tricks.
Urgency and threats, requests for passwords / OTP / card details, KYC and blocked-account scams, lottery and prize lures.
Programs and scripts (.exe, .js, .iso …), disguised double extensions, macro-enabled Office files, HTML login pages, archives.
Each warning adds points. The total (capped at 100) gives the verdict. This is a teaching and triage aid: a low score does not prove an email is safe, so when in doubt, ask your IT team.