Fromensics: Investigate Email Senders

Investigate suspicious Gmail or Outlook on your device. Local AI builds an evidence report. The email never leaves the browser.

Email is where business money moves — and where it gets stolen. Invoice fraud and payment-redirection scams work by changing one detail in a message that looks like it came from someone you trust: a bank account, a link, an amount. Fromensics investigates the Gmail or Outlook on the web message you choose and lets the people you do business with cryptographically sign what they send you. Everything — analysis, keys, contacts — stays on your device. INVESTIGATE ANY MESSAGE Open a message and click Investigate Sender. Fromensics reads that open message on your device — sender, subject, body, and links — and builds an evidence report in the side panel. It does not use the Gmail API or Microsoft Graph and does not request Google or Microsoft account access. • Deterministic checks first: address type, authentication when headers are available, domain alignment, lookalike addresses, URLs, language patterns, and a signed local threat feed. • Chrome’s on-device AI can explain the evidence when available; rules-only analysis is always the fallback. The AI never decides the verdict. • Inspectable evidence. Every finding has a rule id. Checks that could not run are listed, not hidden. VERIFIED CONTACTS — CRYPTOGRAPHY FOR EVERYDAY COMMERCE A compromised mailbox can send a perfect-looking email. A signature from a key held on your contact’s device cannot be faked by whoever hijacked their account. • When you enable it, Fromensics creates an Ed25519 signing key that lives in this browser. The private key is non-extractable, never synced, and never uploaded to Fromensics. • Outgoing messages get a signature footer that commits to what matters in a payment: sender, recipients, subject, links, payment details, and amounts. If any of those change in transit — a swapped IBAN, an added link — verification fails and the message is flagged red. • Pin a contact’s public key from their share link, then see at a glance: verified, unsigned, new key, changed key, or invalid signature. An unsigned message from a pinned contact that asks to change where money goes is floored at Suspicious. • Trust decisions are made by cryptography, not by AI. A first-seen key stays pending until you confirm its fingerprint with the sender out of band. Signing authenticates; it does not encrypt. Single purpose: local sender investigation and signature verification for the message you selected. Not a general page scraper and not an email exporter. It is not an inbox scanner unless you turn on optional contact badges, which read only the visible sender address and a signed footer. PRIVACY BY ARCHITECTURE • Strict local mode (default): the email body, subject, and recipients are not uploaded to Fromensics. • Private live-check (opt-in): may send only a single indicator (a domain, URL hostname, claimed company name, or person name) to DNS-over-HTTPS, RDAP, or — with Pro — https://proxy.fromensics.com (which may query Brave Search). Never the full message. Each lookup is listed in the report. • Signature links keep their payload in the URL fragment; fromensics.com never receives it. • Optional license check sends only the license key and extension version, never the email. • Chrome’s on-device Prompt API may analyze extracted text in the side panel. Chrome may download that model. Fromensics servers do not receive the email for that path. • The last investigation may be stored in Chrome extension storage on this computer. We do not operate a central database of analyzed emails, keys, or contacts. Investigating a sender is free. You do not need an account. Optional Fromensics Pro is sold by Fromensics on Whop (not by Google) and unlocks live lookups through our privacy proxy, site and sibling-domain checks, hosted web/LinkedIn site: search (30 investigations/month), premium feed coverage, and extended local history. Core investigation and Verified Contacts do not require payment. Fromensics is a DBA of Zima Media OÜ (Estonia). It is for people who move money over email and want to inspect a suspicious message — or prove their own are genuine — without sending anything to a third-party scanner. Privacy policy: https://fromensics.com/privacy/ Terms of Service: https://fromensics.com/terms/ Limited Use: https://fromensics.com/limited-use/