# Check a suspicious email for phishing

Staff forward a suspicious email, with screenshots if they have them, and get a reply rating it phishing, suspicious or looks safe, with the reasons: sender and header oddities, where the links really go, and pressure tricks. The agent opens only the main site of each linked domain (for example https://example.com), never the link itself, to see what is there. This is an AI review, not a reputation or blocklist lookup, and "looks safe" is not a guarantee.

**Use cases:** Security, Engineering and IT

**Tags:** phishing, suspicious email, scam, spoofing, email security, security awareness, report phishing, links

[Create this agent](https://seclai.com/agent-examples/create/phishing_email_check)

## How it starts

Trigger: email received.
Accepts files: Screenshots, Other files (ignored).

## What it needs

No knowledge base, memory bank or connection to create first.

## Steps

- List the linked domains
- For each linked domain
  - For each item: Open the domain's main site
  - Describe what the domain hosts
  - Keep the note
- Assess the email
- Parse and validate the verdict
- Reply with the verdict