Third-party notices
The open-source components this tool is built from, their licences, and which of them are actually delivered to your browser.
Two groups, kept apart on purpose. The first is code that runs in your browser when you use this tool. The second is software used to build the site,
which never reaches you. A notices page that mixed them would tell you
nothing about what you are actually running.
Delivered to your browser
Everything in this section is inside the JavaScript and CSS this site
serves. All of it is permissively licensed; none of it is copyleft. None of
it makes a network request - the tool sends nothing anywhere, which you can
check in your browser's Network tab.
React
19.3.0 · MIT
Renders the interface. The analysis itself does not use it.
MIT License
Copyright (c) Meta Platforms, Inc. and affiliates
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
React DOM
19.3.0 · MIT
Attaches that interface to the page.
MIT License
Copyright (c) Meta Platforms, Inc. and affiliates
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Scheduler
0.28.0 · MIT
Decides when React does its work, so the interface stays responsive while a large message is being analyzed. It is a separate package - React DOM’s only dependency - and it is bundled into the same JavaScript, so it belongs on this list in its own right.
MIT License
Copyright (c) Meta Platforms, Inc. and affiliates
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Astro
7.3.2 · MIT
Builds the site. A small part of it - the loader that starts the interface - is also delivered to your browser, which is why it is listed here rather than below.
MIT License
Copyright (c) 2021 Fred K. Schott
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
@astrojs/react
6.0.5 · MIT
Connects the two above.
MIT License
Copyright (c) 2021 Fred K. Schott
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Tailwind CSS
4.3.3 · MIT
Generates the stylesheet. Its baseline reset is part of the CSS this site serves.
MIT License
Copyright (c) Tailwind Labs, Inc.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
tldts
7.4.13 · MIT
Works out which part of a domain name is the registered domain. It carries the Public Suffix List, which has its own licence - see below.
MIT License
Copyright (c) 2017 Thomas Parisot, 2018 Rémi Berson
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
tldts-core
7.4.13 · MIT
Shared helpers that tldts is built on - hostname extraction, IP detection and the like. It does NOT contain the Public Suffix List; that lives in tldts itself. (This entry said the opposite for a while, which would have pointed anyone auditing the list at the wrong package.)
MIT License
Copyright (c) 2017 Thomas Parisot, 2018 Rémi Berson
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
postal-mime
3.0.0 · MIT-0
Parses the message. This is the component that turns raw email source
into headers, parts and text - everything the analysis then reads.
MIT No Attribution
Copyright (c) 2021-2025 Andris Reinman
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
of the Software, and to permit persons to whom the Software is furnished to do
so.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
The Public Suffix List
The list that says which domain endings are registries - that co.jp is a public suffix and example.co.jp is a registered domain.
This tool uses it to decide which part of a sender's domain is the part
someone actually registered, which is how it judges whether an
authentication result belongs to the sender you can see.
It is maintained by the Mozilla Foundation and volunteers, and it ships
inside tldts. It is licensed under the Mozilla Public License 2.0, which is a file-level copyleft licence, and the list travels into this
site's JavaScript.
Where to obtain the source form. The list in its original
form is published at
https://publicsuffix.org/list/public_suffix_list.dat, and the
project's repository is at
https://github.com/publicsuffix/list. The copy this site serves
is the one tldts 7.4.13 packages; that package's own source is
at https://github.com/remusao/tldts.
It is not modified here. The list is consumed exactly as
tldts ships it. It is not re-serialised, filtered, trimmed to a
subset, or converted into another structure.
Mozilla Public License Version 2.0
This Source Code Form is subject to the terms of the Mozilla Public License,
v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain
one at https://mozilla.org/MPL/2.0/.
The full text of the licence is available at https://mozilla.org/MPL/2.0/ and
is distributed with the Public Suffix List source at
https://github.com/publicsuffix/list.
Unicode data
Two data files published by Unicode, Inc. are compiled into this tool:
-
Security Mechanisms confusable characters (
confusables.txt, version 17.0.0, dated 22 July 2025) - the table of characters that
render alike, used to tell a lookalike domain from a real one.
-
Script Extensions from the Unicode Character Database,
version 17.0.0 - which writing systems each character belongs to, used to
tell a name that legitimately mixes Japanese scripts from one that mixes
Latin with Cyrillic.
Both are used under the Unicode Licence v3, and both are
reduced at build time rather than shipped whole - but not in the same way,
and the difference is worth stating because one of them affects what the
tool can detect.
-
The confusable table is filtered by character range, to
the code points that can appear in a domain name. 2,201 of its 6,565
rows are kept. Rows are selected, never altered.
-
Script Extensions is filtered by writing system:
35 of roughly 170 are kept - the ones with meaningful
domain-registration volume, plus those carrying the
confusable-with-Latin attack. Rows are again unaltered, but whole
scripts are dropped, and a character from a dropped script is treated as
carrying no information. That can cause a missed detection. It cannot
cause a false accusation, which is the direction this trade was chosen
to fail in.
UNICODE LICENSE V3
Copyright © 1991-2025 Unicode, Inc.
NOTICE TO USER: Carefully read the following legal agreement. BY DOWNLOADING,
INSTALLING, COPYING OR OTHERWISE USING DATA FILES, AND/OR SOFTWARE, YOU
UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE TERMS AND CONDITIONS
OF THIS AGREEMENT. IF YOU DO NOT AGREE, DO NOT DOWNLOAD, INSTALL, COPY,
DISTRIBUTE OR USE THE DATA FILES OR SOFTWARE.
Permission is hereby granted, free of charge, to any person obtaining a copy of
data files and any associated documentation (the "Data Files") or software and
any associated documentation (the "Software") to deal in the Data Files or
Software without restriction, including without limitation the rights to use,
copy, modify, merge, publish, distribute, and/or sell copies of the Data Files
or Software, and to permit persons to whom the Data Files or Software are
furnished to do so, provided that either (a) this copyright and permission
notice appear with all copies of the Data Files or Software, or (b) this
copyright and permission notice appear in associated Documentation.
THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD
PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN
THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL
DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THE DATA FILES OR
SOFTWARE.
Except as contained in this notice, the name of a copyright holder shall not be
used in advertising or otherwise to promote the sale, use or other dealings in
these Data Files or Software without prior written authorization of the
copyright holder.
Council of Anti-Phishing Japan
Some of this tool's reference data is derived from published research by the Council of Anti-Phishing Japan
(フィッシング対策協議会), whose monthly reports are at www.antiphishing.jp.
Their content-usage terms ask that the source be named and that their
material be distinguishable from anyone else's, which is what this section
is for.
出典：フィッシング対策協議会「月次報告書」をもとに作成
Created from the monthly reports of the Council of Anti-Phishing Japan.
The Japanese above is the wording the Council's own secretariat uses for
this case, and it is the accurate one here: this tool does not reproduce
their tables, it builds its own reference data from facts taken out of
them. Specific reports are cited below.
What is theirs. The measurements. Their March 2026
monthly report records the share of observed phishing by top-level domain - .com 58.9%,
.cn 20.2%, .cfd 13.3% -
and their February 2026 report records that about 54.7% of observed
phishing was sent from the attacker's own registered domain, about 88.9% of
which passed its authentication checks. Those figures are reproduced here
as they published them, so they are cited plainly,
without をもとに作成.
出典：フィッシング対策協議会「月次報告書 2026年3月」
Council of Anti-Phishing Japan, monthly report, March 2026.
https://www.antiphishing.jp/report/monthly/202603.html
出典：フィッシング対策協議会「月次報告書 2026年2月」
Council of Anti-Phishing Japan, monthly report, February 2026.
https://www.antiphishing.jp/report/monthly/202602.html
What is ours. Every decision taken from those
measurements. Which top-level domains this tool treats as carrying extra
weight is our selection, not theirs - the Council publishes shares, not a
list of domains to distrust - and our list deliberately excludes .com and .cn despite
their being the two largest
shares, because those are also where most legitimate mail lives. How much
weight a domain ending carries, and the rule that it can never produce a
verdict on its own, are ours. Any error in those decisions is ours and not
theirs - which is why the reference data
carries をもとに作成, “created based on”, rather than
being offered as their table.
The Council is credited here because their work informed the tool. Nothing
here is endorsed by them, and this is not a statement of affiliation.
Inter
The typeface, by Rasmus Andersson, under the SIL Open Font License 1.1. It is self-hosted: the font files are served from this site, not from a
font CDN, because loading a font from somewhere else would be a network
request made on your behalf and would make this tool's central claim false.
The full licence text is served alongside the font files at
/fonts/Inter-OFL.txt.
Build-time only - not delivered to you
These are used to produce the site and are not part of what your browser
downloads. They are listed for completeness and because one of them carries
a copyleft licence that people reasonably ask about.
- TypeScript 6.0.3 · Apache-2.0
- Type-checks the source.
- @astrojs/check 0.9.10 · MIT
- Runs that type check over Astro files.
- Vite, esbuild, Babel, Lightning CSS various · MIT / MPL-2.0
- Compile and bundle the source.
- sharp / libvips 0.35.4 / 1.3.3 · Apache-2.0 / LGPL-3.0-or-later
- An image processor Astro depends on. The image service is pinned to a no-op, so Astro never invokes it and it emits nothing. The two PNG images this site ships are generated by committed scripts in this repository and rasterised with a browser, not with this package.
No GPL or AGPL component is used at any depth, and no
copyleft-licensed code reaches your browser other than the Public Suffix
List described above.