Phish verification page

A client’s IT team gets a frantic ticket: “This email looks like phishing — should I declare an incident?” Before they spin up an investigation, they want to rule out the boring explanation: it’s one of your phishing tests. The Phish Verification Page at verify.infimasec.com answers that in seconds. Upload the email, or paste a link from it, and get a verdict.

It’s a public page with no login. Share the URL with your clients’ IT teams so they can check for themselves without waiting on you.

When to use it

A client’s IT team escalates a suspicious email and wants to rule a phishing test in or out before opening an incident.
A technician can’t find the email in their mail logs. Phishing tests for sync’d clients often don’t appear in the client’s mail gateway logs or message trace. The verification page doesn’t need them.
A user reported “this is real phishing” through their own channels and you want to confirm whether it’s one of your tests.
Someone wants to confirm a training reminder or welcome email that looks unusual to them came from us.

You’ll need

One of these:

The email saved as a file, .eml or .msg, up to 10 MB.
A link copied from the email. Right-click a link in the email and choose Copy link (in Gmail, Copy link address). Don’t open the link.

How to save an email as a file:

Outlook for Windows (classic) — drag the email from the message list to your desktop, or open it and choose File → Save As. This saves a .msg file.
New Outlook / Outlook on the web — open the email → ⋯ (More actions) → Save as (or Download). This saves an .eml file.
Outlook for Mac — drag the email to your desktop. This saves an .eml file.
Gmail — open the email → ⋮ (More) → Download message. This saves an .eml file.

Save the email the user received rather than a forward of it. If the user forwarded it to IT as an attachment, saving that forward works too.

Verify an email

Open verify.infimasec.com.
Upload the email file — drop it on the upload box or choose it — and select Check email. Or paste a link from the email into the link box and select Check link.
Read the verdict. The page gives one of these answers:
- “Yes, this is an INFIMA phishing simulation” — it’s one of your phishing tests, not a real attack. The page shows when it was sent and the test’s subject and sender name. Details that are filled in for each recipient, like their name or company, appear in brackets, for example [first name]. Check that the subject and sender match the email you have.
- “This email is from INFIMA, and it isn’t a phishing test” — we sent it, but as part of the training program: a training reminder, a welcome email, a report, or similar.
- “We couldn’t match this to INFIMA” — it isn’t a phishing test or another email we can confirm we sent. Treat it as suspicious and follow your incident process. The page lists next steps for the technician.
- “We couldn’t read that file” (or “That doesn’t look like a link”) — the upload wasn’t an email file (or the link wasn’t a whole link starting with https://). Save the email again using the steps above, or paste the whole link.
- “That file is too large” — the file is over 10 MB. Paste a link from the email instead.
- “Too many checks” — a lot of checks have come from your network in the last hour. Try again later.

You’ll know it worked when

The page shows one of the first three verdicts above.
For a phishing test, the subject and sender name on the page match the email in front of you.

Frequently asked

Can the client’s IT team use this directly, or is it partner-only? Anyone can use it. verify.infimasec.com is a public page with no login. Share the URL freely with your clients’ IT teams.

Does the page show who received the test or whether they clicked? No. The page confirms that an email is a phishing test and when it was sent. It never shows who received it, which client it was for, or what the user did. To see that, look up the user’s phishing activity in the dashboard. You can also give the client’s IT staff a View Only account for that.

Does checking an email count as reporting it, or as a click? No. Checking an email or a link changes nothing about the test or the user’s result, and we never open the link you paste. If the user should get credit for reporting it, use Mark as Reported in the dashboard.

It says “We couldn’t match this to INFIMA,” but I’m sure it’s one of our tests. Check, in order: (1) you saved the email the user received, not a forward where the mail client rewrote it (a forward sent as an attachment is fine); (2) you checked the right email; (3) if you pasted a link, it may have been rewritten by an email security tool in a way we can’t read, so upload the email file instead; (4) the user’s phishing activity in the dashboard shows a test sent around that time. If all of that checks out, contact our support team with the email file.

Does it work for clients set up manually rather than through sync? Yes. The verdict comes from the email itself, so it works whichever way the client was set up.

What happens to the file I upload? We read it to give the verdict and don’t keep it, and we never keep the link you paste. We don’t record what the email said.

Can I verify an email that’s already been deleted? Only if you can recover a copy, for example from Deleted Items, Junk, or the client’s mail archive. If it’s gone, check the user’s recent phishing activity in the dashboard instead.

Can I verify multiple emails at once? One email at a time. For a broader look, use the phishing activity view in the dashboard, which lists every test sent to a client’s users.

My client’s IT team is asking me to allow verify.infimasec.com on their mail security. There’s nothing to allow. It’s a web page they open in their browser.

Read phishing activity — every phishing test sent to a client’s users, and what each user did.
Report Phishing button — lets users check a suspicious email from their inbox; this page is the fallback when they can’t use the button.