Inbox Phishing Scan
A hands-off phishing watch on any IMAP inbox. It reads new mail, judges each message deterministically (no AI, no per-run cost), and alerts you only when something is phishing.
This is the always-on, zero-cost counterpart to the AI
phishing-check workflow: instead of asking you for one message
id and reasoning with an LLM, it continuously watches the whole inbox and decides
from verifiable header facts alone.
How it works
| # | Task | Tool | What it does |
|---|---|---|---|
| 1 | read-inbox |
email-read |
Reads unread mail over IMAP, read-only — nothing is marked read, moved, or deleted. Works with any provider (Gmail, Outlook/M365, Yahoo, Fastmail, …) via an app password. |
| 2 | scan |
email-authenticity-scan |
Reports only the phishing messages from SPF/DKIM/DMARC, identity alignment, and link domains. Emits an empty report when the inbox is clean. |
| 3 | alert |
message |
Delivers the report to your InTouch inbox. Self-suppresses on a clean scan (empty subject + body), so you only hear from it when there's a real threat. |
The watermark (why it doesn't re-alert)
email-read carries a {"sinceMillis":N} watermark in its per-task memory.
The engine injects it back as {{self.memory}} → sinceState, so each run only
sees mail that arrived since the last run. Old messages are never re-scanned
or re-alerted.
Memory requires the workflow to be saved/linked (so it has a memory home in
bis_job). Running it purely ad-hoc is stateless and will re-scan the same mail each time — schedule it or save it.
Setup
Credential — <<EMAIL_READ_CREDENTIAL>>: an Email (IMAP Read) credential
with your mail host, login, and an app password (not your account password),
plus the security mode (ssl for port 993, tls for 143). The email-read task
documentation has per-provider app-password instructions.
Contact — <<NOTIFY_PUBLISHER>>: who receives the phishing alert (e.g.
intouch).
Schedule — run it every 5–15 minutes for a continuous watch. The first run reads all current unread mail and sets the watermark; subsequent runs only see new arrivals.
What an alert looks like
INBOX PHISHING SCAN
1 phishing message(s) found out of 12 scanned.
1. [PHISHING · high] URGENT: verify your account now
From: Chase Security <[email protected]>
SPF=fail DKIM=fail DMARC=fail
Why:
- An authentication check explicitly FAILED — strong evidence of spoofing.
- Reply-To domain (gmail.com) (a free webmail address) does NOT match the From domain (chase.com) — a classic phishing tell.
- Body contains URL shortener(s): bit.ly.
Action: Do not click any links or open attachments. Report the message and delete it.
Set includeSuspicious: "true" on the scan task if you also want SUSPICIOUS
messages (auth missing or inconsistent signals) included in the alert.