MailWeft is a phishing email detector that reads the text, headers and links of an email, and says why it flagged it.
How it works
Paste an email, MailWeft returns a verdict and its first reason as soon as one check decides. Try editing the email below.
1From: PayPal Security <service@paypa1-secure.com>2To: you@example.com3Subject: Your account has been limited4Date: Tue, 27 Oct 2026 10:04:00 +053056We noticed unusual activity on your account. Confirm your details within 24 hours at http://paypa1-secure.com/login or your account will be suspended.—
Rule checks answer first. The B3 model, the scam memory and the LLM judge follow, and each one adds its reasons. The playground shows how long each took.
Why MailWeft?
On 1,066 phishing emails from 2025, all of MailWeft's checks together caught 758 (71%) and flagged 2 of 66 legitimate inbox emails. Its B3 model alone is close to the best standard model, and unlike them MailWeft gives the reason for every verdict.
| MailWeft B3 | Naive Bayes | Random forest | Linear SVM | |
|---|---|---|---|---|
| Phishing caught of 1,066 | 53–64% | 54% | 46% | 32% |
| Inbox emails flagged of 66 | 2–3 | 0 | 1 | 0 |
| Ranking score ROC AUC, 1 is perfect | 0.92–0.95 | 0.947 | 0.936 | 0.957 |
| Gives reasons | Yes | No | No | No |
| Checks reply threads | Yes | No | No | No |
Ranges cover three training runs of B3; this site runs the 64% one. The alert line flags at most 1% of legitimate mail kept aside for setting it. The 71% uses the site's own lines; see Results.
MailWeft in your app
Send the raw email to the API.
1curl --data-binary @message.eml https://api.mailweft.com/v1/check1const response = await fetch('https://api.mailweft.com/v1/check', {2 method: 'POST',3 body: rawEmail,4});5const text = await response.text();6const events = text.trim().split('\n').map((line) => JSON.parse(line));7const verdict = events.find((event) => event.event === 'done').verdict;The answer is a stream of JSON lines, one per check. A verdict line arrives with the first check that decides, and again whenever a later check changes the verdict. The last line, done, has the final verdict.
Explore
Playground
Check an email, a sample or an .eml file.
How it works
Follow an email through each check.
Results
Compare MailWeft with standard models.
Datasets
See where the 31,563 emails come from.
MailWeft in use
MailWeft is a Secure Software Engineering project by Team 6 at IIT Hyderabad: Anup Chavan, Vanamala Aman Preetham and Satyam Singh.