Real-Time Phishing Email Detection: How SecureLint Scans Every Message Before You Click

A carefully crafted phishing email lands in your inbox. The sender name looks familiar. The logo matches. The call-to-action is urgent. You click the link before your brain has time to run the checks your eyes skipped. That moment — between seeing the email and clicking the link — is where SecureLint operates.

SecureLint's phishing detection engine analyses every email you open in Gmail and Outlook Web in real time, computing a 0–100 trust score from 14 independent threat signals. High-risk emails get a red warning banner before you can click any link. Low-trust links trigger an interstitial popup the moment you click them.

Why email phishing still succeeds in 2026

Email authentication standards (SPF, DKIM, DMARC) have existed for over a decade — yet phishing remains the leading initial access vector in over 80% of breaches. The reason is that sophisticated attackers have adapted:

• Lookalike domains — Registering paypa1.com or micro-soft.com and sending emails that pass SPF and DKIM on those domains
• Compromised legitimate accounts — Sending phishing emails from a real colleague's hacked account, which passes all authentication checks
• Link redirectors — Embedding links through legitimate services (Google Docs, OneDrive, Dropbox) that redirect to phishing pages only after email gateway scanning
• Zero-day phishing kits — Purpose-built pages that use valid SSL certificates, legitimate-looking UI, and are hosted on domains registered within the last 24 hours

SecureLint's 14-signal email analysis

Each email is scored across 14 independent signals, grouped into four categories:

• Authentication signals — SPF pass/fail, DKIM signature validity, DMARC policy enforcement (none / quarantine / reject)
• Sender identity signals — Display name vs. envelope sender mismatch, reply-to address mismatch, sender domain age (domains younger than 30 days are high-risk), brand impersonation pattern matching against 500+ known brands
• Link signals — Each link URL is scored for domain reputation, SSL certificate age, redirect chain depth, URL encoding obfuscation, and homograph / IDN substitution attacks
• Content signals — Attachment MIME type risk, phishing keyword density (urgency language, credential request patterns, account suspension threats), and known phishing template fingerprints

SPF, DKIM, and DMARC: what they check and what they miss

These three standards form the baseline of email authentication — but each has blind spots that SecureLint's additional signals are designed to cover.

• SPF (Sender Policy Framework) checks whether the sending mail server is authorized to send on behalf of the domain in the email envelope. It does not check the From header visible to the user, which is why display name spoofing is still possible even with a passing SPF record.
• DKIM (DomainKeys Identified Mail) verifies that the email was cryptographically signed by the claimed domain. A passing DKIM signature means the email was not tampered with in transit — but it says nothing about whether the sending domain itself is malicious.
• DMARC (Domain-based Message Authentication) ties SPF and DKIM together and specifies what the receiving server should do with failures. A DMARC policy of p=none provides reporting but no protection. Only p=quarantine or p=reject actually block spoofed emails.

Real-time link threat scoring

Every link in an email body is scored before you click it. SecureLint checks:

• Domain age — Domains registered within 30 days of the email date are flagged as high-risk. Most phishing infrastructure is burned and replaced within weeks.
• SSL certificate age — A certificate issued within 72 hours of the email is a strong phishing signal.
• Brand impersonation — The domain is checked against patterns for 500+ major brands. paypal-security-verify.com triggers a brand impersonation flag even though it passes SSL.
• Redirect chain depth — Phishing links often chain through two or three redirectors to bypass gateway scanning. SecureLint flags links with redirect chains longer than two hops.
• IDN homograph attacks — Unicode lookalike characters (е vs e, а vs a) are normalised and checked for brand impersonation.

Attachment risk fingerprinting

SecureLint does not download attachments for scanning (that would require server-side processing). Instead, it fingerprints the attachment metadata visible in the email DOM:

• MIME type vs. file extension mismatch (e.g., a .pdf with an application/exe MIME type)
• High-risk file extensions: .exe, .js, .vbs, .wsf, .hta, .iso, .lnk
• Password-protected archives (common phishing technique to bypass content scanning)
• Office documents with macro-enabled extensions (.xlsm, .docm)

The 0–100 trust score

All 14 signals are combined into a single 0–100 trust score, displayed as a colour-coded gauge on each email:

• 80–100 (Green) — All authentication signals pass; no threat indicators detected. Safe to interact with.
• 50–79 (Amber) — Some signals are suspicious. Review before clicking any links.
• 0–49 (Red) — Multiple high-risk signals detected. SecureLint displays a warning banner and blocks link clicks pending your confirmation.

Setting up phishing detection in SecureLint