About Rubiscout
Email security intelligence
for everyone — not just experts.
Rubiscout analyzes email headers and full emails with AI to tell you clearly whether an email is a phishing attack, spoofed, or safe — in plain English, in seconds, for free. For security operations teams, a streaming REST API runs a full multi-step investigation and delivers IOCs and MITRE ATT&CK-mapped TTPs in real time.
The problem with existing tools
Email header analyzers have existed for years. Tools like MXToolbox, Google's Admin Toolbox, and Mail Header Analyzer all parse headers and surface raw technical data. They are built for IT administrators who already know what SPF alignment failures and DMARC policy cascades mean.
The vast majority of phishing victims are not IT administrators. They receive a suspicious email, want to know if it's dangerous, and are confronted with a wall of green and red table cells they cannot interpret. They close the tab and either delete the email or — worse — trust it anyway.
What makes Rubiscout different
A verdict in plain English
Every analysis leads with a single sentence written for a non-technical reader. "This email is a phishing attack pretending to be PayPal — do not click any links." Not a table. Not a score. A sentence you can act on.
AI-powered forensics, not just parsing
Rubiscout uses Claude (Anthropic's frontier AI model) to reason across all header fields together — routing anomalies, authentication failures, Reply-To mismatches, and spoofed display names — the way a security analyst would, not a regex engine.
Authentication gauge with alignment detail
SPF, DKIM, and DMARC results are shown in a visual compliance gauge alongside alignment mode (relaxed or strict) and the published DMARC enforcement policy (none, quarantine, or reject) — so you can see not just whether authentication passed, but how tightly the domain enforces it.
Live DNS validation — six record types
Rubiscout performs live DNS lookups at analysis time for SPF, DMARC, MTA-STS, TLS-RPT, and BIMI records. You see what the domain actually publishes, not just what the headers claim — and any gap between the two is flagged immediately.
IP reputation check
The sending IP is checked in real time against five major DNSBL reputation databases (Spamhaus ZEN, SpamCop, Barracuda, SORBS, SpamRATS). No API key, no third-party dependency — pure DNS.
Hop timing visualization
The email's routing path is shown hop-by-hop with per-hop delay bars — color-coded green to red. Delays over 30 minutes between hops are automatically flagged as suspicious, a common sign of botnet relays or held-mail attacks.
Actionable recommendations
Instead of stopping at 'DMARC: fail', Rubiscout gives you 3–5 specific steps tailored to this exact email's threat profile — concrete actions based on what was actually found, not generic advice.
Streaming investigation agent — a new kind of email analysis API
POST /api/v1/investigate accepts a full RFC 2822 email and streams a real-time Server-Sent Events investigation powered by Claude Opus. The agent runs five live intelligence tools — DNS lookup, IP intel (DNSBL + fCrDNS + ASN), domain intel (RDAP age + lookalike detection against 40 brands), URL extraction (text + HTML + mismatch detection), and URL reputation (Google Safe Browsing + heuristic fallback) — and streams its reasoning as it works. The final report includes structured IOCs (IPs, domains, URLs, email addresses) and TTPs mapped to MITRE ATT&CK IDs, designed for direct SOAR integration. No other free email analysis tool does this.
Investigative Bench
After every analysis, an AI-powered chat interface stays visible alongside the results. Ask follow-up questions, get technical terms explained, or dig into a specific red flag — all with full header context already loaded. No re-pasting required.
Community verdicts
Security researchers and IT teams can add verdicts (phishing, BEC, spam, legitimate, unknown) to any analysis. Verdicts are visible on the shared analysis page and help build a community-labeled dataset of real-world email threats.
Phishing incident reports
For Critical and High risk emails, Rubiscout generates a professional printable incident report — suitable for forwarding to IT, HR, or law enforcement — as a downloaded PDF or browser print in one click.
Shareable analysis links
Every analysis gets a permanent URL you can share with a colleague, an IT team, or a security researcher — no account required.
Who it's for
Individuals
Received a suspicious email and want a straight answer before clicking anything.
Security operations (SOC)
Needs a streaming investigation API that returns IOCs, MITRE ATT&CK TTPs, and SOAR-ready structured output — without building the tooling from scratch.
IT & security teams
Need a fast triage tool that produces shareable, printable reports for incident response.
Finance & HR teams
Common BEC targets who need to spot wire-fraud and impersonation attacks without reading RFCs.
Security researchers
Want live DNS validation, full forensic detail, and API access to a real-world email analysis corpus.
Developers & MSSPs
Want a REST API for automated email triage in their own security products, pipelines, or managed service workflows.
Built on
Rubiscout is built with Next.js 16, Tailwind CSS 4, and TypeScript. Header analysis is powered by Claude Sonnet 4.6. The streaming investigation agent runs on Claude Opus 4.8 with a five-tool agentic loop (DNS, IP intel, domain intel, URL extraction, URL reputation). DNS lookups and IP reputation checks run server-side in Node.js — no third-party APIs, no account required. Recipient addresses are never stored. Analysis results are saved in Supabase and accessible via shareable link or REST API. Users can optionally contribute analyses to Rubiscout's security research dataset — no recipient data is included.