Paste a suspicious email or upload its .eml file. SARA parses authentication headers, enriches URLs against the same 8-source TI stack we use for tenants, scores attachments, and returns a verdict with recommended next actions.
Email content is processed in-memory only — we never persist your email body. Headers, URLs, and sender IPs are queried against public threat-intel sources; body text is not sent to upstream APIs. There are no submission permalinks; every analysis is one-shot.
It parses the email's headers (SPF, DKIM, DMARC, Received chain), extracts every URL and attachment, scores them against 8 threat-intel sources, and surfaces the deceptive patterns attackers use — look-alike domains, encoded display names, mismatched Reply-To, base64-encoded URLs in the body. The output is a verdict you can hand a Tier-1 analyst, not raw header dumps.
A user forwarded a suspicious email. Skip the manual header-parsing pass — paste it here and get a verdict you can defend to the user.
Business-email-compromise hinges on look-alike domains and reply-to swaps; SARA flags both deterministically.
Run real (defanged) phish past the tool with your team — turns SOC analysis into a teachable demo.
Wire /api/v1/phishing-analyze into your mail-gateway quarantine for first-pass verdicts before human review.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/phishing-analyze — SPF/DKIM/DMARC parsing, URL enrichment, and attachment risk scoring on any email or .eml.
curl -X POST https://sara-open.sirp.io/api/v1/phishing-analyze \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"raw_text": "Received: from …"}'
Read the API reference →