MailWeft is a phishing email detector that reads the text, headers and links of an email, and says why it flagged it.

How it works

Paste an email, MailWeft returns a verdict and its first reason as soon as one check decides. Try editing the email below.

Email
From: PayPal Security <service@paypa1-secure.com>To: you@example.comSubject: Your account has been limitedDate: Tue, 27 Oct 2026 10:04:00 +0530We noticed unusual activity on your account. Confirm your details within 24 hours at http://paypa1-secure.com/login or your account will be suspended.

Rule checks answer first. The B3 model, the scam memory and the LLM judge follow, and each one adds its reasons. The playground shows how long each took.

Why MailWeft?

On 1,066 phishing emails from 2025, all of MailWeft's checks together caught 758 (71%) and flagged 2 of 66 legitimate inbox emails. Its B3 model alone is close to the best standard model, and unlike them MailWeft gives the reason for every verdict.

MailWeft B3Naive BayesRandom forestLinear SVM
Phishing caught of 1,06653–64%54%46%32%
Inbox emails flagged of 662–3010
Ranking score ROC AUC, 1 is perfect0.92–0.950.9470.9360.957
Gives reasonsYesNoNoNo
Checks reply threadsYesNoNoNo

Ranges cover three training runs of B3; this site runs the 64% one. The alert line flags at most 1% of legitimate mail kept aside for setting it. The 71% uses the site's own lines; see Results.

MailWeft in your app

curl --data-binary @message.eml https://api.mailweft.com/v1/check

The answer is a stream of JSON lines, one per check. A verdict line arrives with the first check that decides, and again whenever a later check changes the verdict. The last line, done, has the final verdict.

Explore

MailWeft in use

MailWeft is a Secure Software Engineering project by Team 6 at IIT Hyderabad: Anup Chavan, Vanamala Aman Preetham and Satyam Singh.