We take the bite so you don't.
Forward any sketchy email to bite@bait.sh. We open every link and file in a sealed sandbox, screenshot where it really goes, and tell you in plain English what it wants from you.
Private beta. Invite only for now.
Example check of a sketchy email:
- received: "Your package is on hold"
- link 1: following 4 redirects...
- landed on: parcel-redelivery-help[.]top
- page asks for: card number
- screenshot saved
- verdict: HOOKED
How it works
-
1. Forward it.
Send anything sketchy to bite@bait.sh.
-
2. We bite.
We open every link and file in a sealed sandbox, so you don't have to.
-
3. You get the catch.
A plain-English report in minutes: where it goes, what it wants, what to do.
Tip: forward as an attachment for the most detailed report.
What we check
-
Every link
We follow every redirect to where it really lands.
-
Every file
We open PDFs, Office docs, zips and fake login pages.
-
Real screenshots
See exactly what you would have seen.
-
Who really sent it
We spot fake senders and lookalike addresses.
-
What it wants
AI reads it for scam tricks, even when there are no links.
-
Hidden stuff
We look for QR codes, lookalike domains and brand-new sites.
The verdict
-
NO BAIT FOUND
Nothing risky found.
-
LOOKS LIKE BAIT
Suspicious, don't trust it.
-
HOOKED
Malicious or a clear scam.
Not just email. Anything sus.
Email is just the start. Soon you'll be able to send us anything that looks like bait.
- Texts Soon
- Screenshots Soon
- Links Soon
- QR codes Soon
- Files Soon
- Browser extension Soon
- Family plan Soon
- Teams Soon
Sample report
See a sample reportHOOKED
This is a fake delivery notice that sends you to a card-stealing page.
- Pretends to be
- ParcelDash delivery
- Wants
- Your card number
- Really goes to
- parceldash-redelivery[.]example
FAQ
Who can use it?
Right now it's a private beta, invite only.
Do you actually click the links?
Yes, inside a sealed sandbox that's thrown away after every check. Nothing touches your device.
Is my email private?
We keep the email for 7 days and the report for 30, then delete them. No ads, no selling data, no ad trackers.
Is it 100% accurate?
No tool is. bait.sh catches a lot, but when in doubt, don't click.