Fromensics: Investigate Email Senders

Investigate suspicious Gmail or Outlook on your device. Local AI builds an evidence report. The email never leaves the browser.

Investigate suspicious emails without uploading the message to a third-party scanner. Fromensics adds an Investigate Sender button to Gmail. Select a message, click the button, and receive an evidence-based security report in Chrome’s side panel. The extension examines the message you choose—not your entire inbox. What Fromensics checks Sender address and display-name inconsistencies Authentication details when Gmail makes them available Sender, signing, and claimed-company domain alignment Lookalike domains and misleading links Suspicious language, urgency, and impersonation signals Matches against a signed threat-intelligence feed stored locally Checks that could not be performed, so missing evidence is never hidden Each report includes a risk score, verdict, supporting findings, and recommended next steps. Fromensics is a decision-support tool and cannot guarantee that a message is safe or malicious. Local-first privacy Strict Local mode is the default. Message analysis runs primarily on your device. Fromensics does not upload or centrally store your email body. The current version does not use the Gmail API or request access to your Google account. Chrome’s optional on-device AI may analyze message text locally when supported. A rules-only investigation remains available without AI. Signed threat-feed updates contain security indicators—not your messages. The extension stores the current investigation and limited history in Chrome storage on your device. Free keeps up to 50 investigation records; Pro keeps up to 500. You can remove this data by clearing the extension’s storage or uninstalling it. Optional Private Live-Check If you explicitly enable Private Live-Check, Fromensics may send a single domain or hostname to DNS or domain-registration services. It does not send the message body, subject, recipients, full headers, or complete private URLs. Every attempted external lookup is identified in the report. Free core and optional Pro Core sender investigation is free and does not require an account. Optional Fromensics Pro adds: Live lookups through the Fromensics privacy proxy Premium threat-feed coverage Extended local investigation history Pro is purchased through Whop and is not required for the core investigation experience. License validation sends only the license key and extension version—never the email. Permissions Fromensics requests access only to the services required for its disclosed features: Gmail, to add the investigation button and read the message you select Storage, to save settings, local reports, and the threat feed Side panel, to display investigation results Alarms, to schedule signed threat-feed updates Specific DNS, RDAP, and Fromensics services for optional lookups and operational updates Privacy Policy: https://fromensics.com/privacy/ Limited Use Statement: https://fromensics.com/limited-use/ Investigate locally. Block collectively. Verify openly.