Phishing Protector (Outlook)

Phishing Protector is an Outlook add-in that scans the content and the links of the email you open and warns you about phishing attempts. It runs in Outlook on the web and in the desktop app. Quick checks happen directly in the add-in panel, while checks that need the network are done by a small FastAPI service running on my own server.

Purpose

Phishing emails are no longer full of clumsy spelling mistakes. The sender's display name shows a bank or a well-known brand, the visible text of a link shows a real domain, and the subject line uses rushed language such as "your account will be closed". Expecting a user to check all of this on every single email is not realistic. I wanted a helper that looks for these signs the moment an email is opened and shows the result right above it.

How it works

When an email is opened, the add-in first examines the email itself. It compares the sender's display name with the domain of the real address, checks whether the reply-to address points to a different domain, and inspects the attachments and the HTML body.

Then it moves on to the links and looks in each one for lookalike characters, for a mismatch between the visible text and the real target, and for shortened addresses. These first two stages run entirely inside the panel, instantly and without contacting the server. Links that pass them are sent to the server. For each link the server first looks up the DNS record, then checks whether the address is reachable, and finally starts a fresh analysis on VirusTotal, a service that checks an address against more than 70 antivirus engines at once. If a step fails, the following steps are skipped so that the limited VirusTotal quota is not wasted. All results are merged and shown in the panel and in the notification bar above the email.

Key features

• It catches sender spoofing: if the display name mentions a brand such as Microsoft, Google, Apple, Amazon, PayPal, Netflix or a bank while the email comes from another domain, it warns you.
• It warns when the reply-to address leads to a different domain than the sender.
• It searches the subject and body for Turkish and English pressure phrases and raises a medium-level warning on two or more matches.
• It checks more than 40 dangerous file extensions such as .exe, .scr, .bat, .docm and .xlsm.
• It warns when a form or input field is embedded in the email.
• It detects homograph attacks that use Cyrillic, Greek or fullwidth characters. A homograph attack spells a fake domain with letters from other alphabets that look almost identical to Latin ones.
• It separately flags links whose visible text shows one domain while the real target goes somewhere else.
• It marks links from 19 shortening services such as bit.ly and tinyurl, because they hide the real destination.
• It finds unregistered or dead domains with a DNS lookup.

Technical stack

The add-in is built as an Outlook Web Add-in so that the same code runs on Windows, Mac and Outlook on the web. That is why I did not choose the older COM add-ins, which only work on Windows. The front end is plain HTML, CSS and JavaScript with no npm or bundler, and the Office.js library is loaded from Microsoft's own servers.

The backend is written in FastAPI and runs on Gunicorn with Uvicorn workers behind Nginx. DNS lookups go directly to Google's DNS server through dnspython, which avoids some internet providers redirecting nonexistent domains to their own pages. HTTP checks are asynchronous with httpx, and up to 50 links in an email are scanned in parallel. VirusTotal results are polled every 2 seconds, up to 8 times.

In desktop Outlook the panel can be pinned, and while it is pinned the scan restarts automatically when you switch to another email. I learned several strict rules of Outlook's manifest schema by trial and error, such as the order of elements and which version block may declare pinning support, and wrote them down. Eight sample emails covering different attack types are kept in the repository for testing.

Limitations

Pinning the panel only works in desktop Outlook. The reply-to check relies on an API offered by newer Outlook versions, so it cannot run on older ones. Pressure language detection is keyword based, so it can raise false alarms or miss some phrasing. The free VirusTotal quota is limited to 4 requests per minute, so emails with many links can hit that limit.

Use cases

• Companies can use it as an extra layer protecting their staff against phishing.
• It helps accounting and finance teams whose inboxes are full of invoices, shipping notices and bank notifications.
• Because it shows concrete reasons why an email is suspicious, it can serve as an example in awareness training.
• Together with the Thunderbird add-in that shares the same backend, it gives consistent checks to teams using different email clients.