---
title: MailWeft · Phishing email detection that shows its reasons
description: MailWeft is a phishing email detector that reads the text, headers and links of an email, and says why it flagged it.
---

# MailWeft

MailWeft is a [phishing email detector](/how-it-works) that reads the text, headers and links of an email, and [says why it flagged it](/playground).

## How it works

Paste an email, MailWeft returns a verdict and its first reason as soon as one check decides.

```email
From: PayPal Security <service@paypa1-secure.com>
Subject: Your account has been limited

We noticed unusual activity on your account. Confirm your details within 24 hours at http://paypa1-secure.com/login or your account will be suspended.
```

```
Phishing
By the rule checks: sender domain paypa1-secure.com uses a character-swapped copy of the name 'paypal' (paypal), but paypa1-secure.com is not one of its domains
```

Rule checks answer first. The B3 model, the scam memory and the LLM judge follow, and each one adds its reasons.

## Why MailWeft?

On 1,066 phishing emails from 2025, all of MailWeft's checks together caught 758 (71%) and flagged 2 of 66 legitimate inbox emails. Its B3 model alone is close to the best standard model, and unlike them MailWeft gives the reason for every verdict.

| | MailWeft B3 | Naive Bayes | Random forest | Linear SVM |
| --- | --- | --- | --- | --- |
| Phishing caught (of 1,066) | 53–64% | 54% | 46% | 32% |
| Inbox emails flagged (of 66) | 2–3 | 0 | 1 | 0 |
| Ranking score (ROC AUC, 1 is perfect) | 0.92–0.95 | 0.947 | 0.936 | 0.957 |
| Gives reasons | Yes | No | No | No |
| Checks reply threads | Yes | No | No | No |

Ranges cover three training runs of B3; this site runs the 64% one. The alert line flags at most 1% of legitimate mail kept aside for setting it. The 71% uses the site's own lines; see [Results](/results#whole-system).

## MailWeft in your app

Send the raw email to the [API](/api).

```sh
curl -sN --data-binary @message.eml "$MAILWEFT_API/v1/check"
```

The answer is a stream of JSON lines, one per check. A `verdict` line arrives with the first check that decides, and again whenever a later check changes it. The last line, `done`, has the final verdict.

## Explore

- [Playground](/playground): check an email, a sample or an .eml file.
- [How it works](/how-it-works): follow an email through each check.
- [Results](/results): compare MailWeft with standard models.
- [Datasets](/datasets): see where the 31,563 emails come from.