Stonephish — see where every link really goes

Warns you about scam and phishing emails in plain English — forged senders, fake support numbers, and money you can't get back.

Most scam emails don't need malware. They just need you to click a link, ring a number, or send money. Stonephish sits quietly in your inbox and tells you, in plain words, when a message is doing one of those things. WHERE EVERY LINK ACTUALLY GOES Not the text of the link — the real destination, shown before you click. A button reading "Cancel this payment" that leads to a lookalike domain registered last week is the whole scam in one line. It also reads addresses hidden inside QR codes and PDF attachments, which no email app shows you. WHEN A SENDER ISN'T WHO THEY CLAIM A support team writing from a domain that has nothing to do with the company. A grandchild writing from an address that only resembles a real one. The genuine sending domains of hundreds of banks, retailers, couriers and government agencies are built in, and any mismatch is spelled out plainly. WHEN A PHONE NUMBER ISN'T THEIRS Fake receipts work by getting you to call. There is no link to click, so nothing looks wrong. The number in the message gets checked against the real one. WHEN THE MONEY COULD NEVER BE GOT BACK Some ways of paying cannot be undone, and scams choose them deliberately. Those requests are recognised, along with the pressure that arrives with them — the demand for secrecy, the emergency story, the refund you are asked to send back on an overpayment that never happened. WRITTEN FOR PEOPLE, NOT SECURITY TEAMS There is no risk score to interpret and no jargon. When something is wrong, Stonephish names the specific trick and tells you what to do instead. It is built to be understood by the person in your family most likely to be targeted. It also stays quiet. A tool that cries wolf gets switched off, so the warnings are tuned hard against false alarms: an ordinary receipt or newsletter passes by in silence. NOTHING LEAVES YOUR BROWSER Version 1.0 runs entirely on your device. No account. No sign-in. No server. Your email is never uploaded, stored, logged or sold, because it is not sent anywhere in the first place. Open your browser's developer tools, watch the network tab, and you will see no requests at all. Works in Gmail and in the other major webmail services you can open in a browser. Free, with no ads and no upsell in the warnings.