Third-party notices

The open-source components this tool is built from, their licences, and which of them are actually delivered to your browser.

Two groups, kept apart on purpose. The first is code that runs in your browser when you use this tool. The second is software used to build the site, which never reaches you. A notices page that mixed them would tell you nothing about what you are actually running.

Delivered to your browser

Everything in this section is inside the JavaScript and CSS this site serves. All of it is permissively licensed; none of it is copyleft. None of it makes a network request - the tool sends nothing anywhere, which you can check in your browser's Network tab.

React

19.3.0 · MIT

Renders the interface. The analysis itself does not use it.

React DOM

19.3.0 · MIT

Attaches that interface to the page.

Scheduler

0.28.0 · MIT

Decides when React does its work, so the interface stays responsive while a large message is being analyzed. It is a separate package - React DOM’s only dependency - and it is bundled into the same JavaScript, so it belongs on this list in its own right.

Astro

7.3.2 · MIT

Builds the site. A small part of it - the loader that starts the interface - is also delivered to your browser, which is why it is listed here rather than below.

@astrojs/react

6.0.5 · MIT

Connects the two above.

Tailwind CSS

4.3.3 · MIT

Generates the stylesheet. Its baseline reset is part of the CSS this site serves.

tldts

7.4.13 · MIT

Works out which part of a domain name is the registered domain. It carries the Public Suffix List, which has its own licence - see below.

tldts-core

7.4.13 · MIT

Shared helpers that tldts is built on - hostname extraction, IP detection and the like. It does NOT contain the Public Suffix List; that lives in tldts itself. (This entry said the opposite for a while, which would have pointed anyone auditing the list at the wrong package.)

The MIT licence text, for the 8 components above

The permission notice below is the MIT licence, and it applies to each of the 8 components listed above - React, React DOM, Scheduler, Astro, @astrojs/react, Tailwind CSS, tldts, and tldts-core - individually and in full, together with that component's own copyright notice as printed with it. It is reproduced once rather than once per component because the text is identical in all eight cases; nothing is abridged and no component is covered by less than the whole of it.

postal-mime is not covered by this notice. It is MIT-0, a different licence with different terms and no attribution clause, and its full text is reproduced with its own entry below.

MIT License Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

postal-mime

3.0.0 · MIT-0

Parses the message. This is the component that turns raw email source into headers, parts and text - everything the analysis then reads.

MIT No Attribution Copyright (c) 2021-2025 Andris Reinman Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

The Public Suffix List

The list that says which domain endings are registries - that co.jp is a public suffix and example.co.jp is a registered domain. This tool uses it to decide which part of a sender's domain is the part someone actually registered, which is how it judges whether an authentication result belongs to the sender you can see.

It is maintained by the Mozilla Foundation and volunteers, and it ships inside tldts. It is licensed under the Mozilla Public License 2.0, which is a file-level copyleft licence, and the list travels into this site's JavaScript.

Where to obtain the source form. The list in its original form is published at https://publicsuffix.org/list/public_suffix_list.dat, and the project's repository is at https://github.com/publicsuffix/list. The copy this site serves is the one tldts 7.4.13 packages; that package's own source is at https://github.com/remusao/tldts.

It is not modified here. The list is consumed exactly as tldts ships it. It is not re-serialised, filtered, trimmed to a subset, or converted into another structure.

Mozilla Public License Version 2.0 This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain one at https://mozilla.org/MPL/2.0/. The full text of the licence is available at https://mozilla.org/MPL/2.0/ and is distributed with the Public Suffix List source at https://github.com/publicsuffix/list.

Unicode data

Two data files published by Unicode, Inc. are compiled into this tool:

Security Mechanisms confusable characters (confusables.txt, version 17.0.0, dated 22 July 2025) - the table of characters that render alike, used to tell a lookalike domain from a real one.
Script Extensions from the Unicode Character Database, version 17.0.0 - which writing systems each character belongs to, used to tell a name that legitimately mixes Japanese scripts from one that mixes Latin with Cyrillic.

Both are used under the Unicode Licence v3, and both are reduced at build time rather than shipped whole. What that reduction costs in detection is a limit of the tool rather than a licence notice, so it is stated on what this tool cannot detect - a page published in every language this site offers, which this one is not.

UNICODE LICENSE V3 Copyright © 1991-2025 Unicode, Inc. NOTICE TO USER: Carefully read the following legal agreement. BY DOWNLOADING, INSTALLING, COPYING OR OTHERWISE USING DATA FILES, AND/OR SOFTWARE, YOU UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE TERMS AND CONDITIONS OF THIS AGREEMENT. IF YOU DO NOT AGREE, DO NOT DOWNLOAD, INSTALL, COPY, DISTRIBUTE OR USE THE DATA FILES OR SOFTWARE. Permission is hereby granted, free of charge, to any person obtaining a copy of data files and any associated documentation (the "Data Files") or software and any associated documentation (the "Software") to deal in the Data Files or Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, and/or sell copies of the Data Files or Software, and to permit persons to whom the Data Files or Software are furnished to do so, provided that either (a) this copyright and permission notice appear with all copies of the Data Files or Software, or (b) this copyright and permission notice appear in associated Documentation. THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THE DATA FILES OR SOFTWARE. Except as contained in this notice, the name of a copyright holder shall not be used in advertising or otherwise to promote the sale, use or other dealings in these Data Files or Software without prior written authorization of the copyright holder.

Council of Anti-Phishing Japan

Some of this tool's reference data is derived from published research by the Council of Anti-Phishing Japan (フィッシング対策協議会), whose monthly reports are at www.antiphishing.jp. Their content-usage terms ask that the source be named and that their material be distinguishable from anyone else's, which is what this section is for.

出典：フィッシング対策協議会「月次報告書」をもとに作成 Created from the monthly reports of the Council of Anti-Phishing Japan. The Japanese above is the wording the Council's own secretariat uses for this case, and it is the accurate one here: this tool does not reproduce their tables, it builds its own reference data from facts taken out of them. Specific reports are cited below.

What is theirs. The measurements. Their March 2026 monthly report records the share of observed phishing by top-level domain - .com 58.9%, .cn 20.2%, .cfd 13.3% - and their February 2026 report records that about 54.7% of observed phishing was sent from the attacker's own registered domain, about 88.9% of which passed its authentication checks. Those figures are reproduced here as they published them, so they are cited plainly, without をもとに作成.

出典：フィッシング対策協議会「月次報告書 2026年3月」 Council of Anti-Phishing Japan, monthly report, March 2026. https://www.antiphishing.jp/report/monthly/202603.html

出典：フィッシング対策協議会「月次報告書 2026年2月」 Council of Anti-Phishing Japan, monthly report, February 2026. https://www.antiphishing.jp/report/monthly/202602.html

What is ours. Every decision taken from those measurements. Which top-level domains this tool treats as carrying extra weight is our selection, not theirs - the Council publishes shares, not a list of domains to distrust - and our list deliberately excludes .com and .cn despite their being the two largest shares, because those are also where most legitimate mail lives. How much weight a domain ending carries, and the rule that it can never produce a verdict on its own, are ours. Any error in those decisions is ours and not theirs - which is why the reference data carries をもとに作成, “created based on”, rather than being offered as their table.

The Council is credited here because their work informed the tool. Nothing here is endorsed by them, and this is not a statement of affiliation.

Inter

The typeface, by Rasmus Andersson, under the SIL Open Font License 1.1. It is self-hosted: the font files are served from this site, not from a font CDN, because loading a font from somewhere else would be a network request made on your behalf and would make this tool's central claim false.

The full licence text is served alongside the font files at /fonts/Inter-OFL.txt.

Build-time only - not delivered to you

These are used to produce the site and are not part of what your browser downloads. They are listed for completeness and because one of them carries a copyleft licence that people reasonably ask about.

TypeScript 6.0.3 · Apache-2.0: Type-checks the source.
@astrojs/check 0.9.10 · MIT: Runs that type check over Astro files.
Vite, esbuild, Babel, Lightning CSS various · MIT / MPL-2.0: Compile and bundle the source.
sharp / libvips 0.35.4 / 1.3.3 · Apache-2.0 / LGPL-3.0-or-later: An image processor Astro depends on. The image service is pinned to a no-op, so Astro never invokes it and it emits nothing. The two PNG images this site ships are generated by committed scripts in this repository and rasterised with a browser, not with this package.

No GPL or AGPL component is used at any depth, and no copyleft-licensed code reaches your browser other than the Public Suffix List described above.