RookScan Email & File Scanner

Analyze phishing emails, PDFs, and installers with AI — in the browser or by forwarding mail to [email protected].

Phishing campaigns now use AI-generated copy and polished attachments. RookScan gives you a structured verdict (safe, suspicious, malicious, or unknown) with explanations you can act on — without installing desktop antivirus for a quick check.

When to use RookScan

Use RookScan when you receive an unexpected invoice, password-reset message, parcel notice, or attachment from someone you do not fully trust. It is especially useful for .eml, .msg, HTML saves, PDFs, Office documents, and small installers — file types attackers reuse across industries.

RookScan is not a replacement for enterprise EDR on managed workstations. It is a fast second opinion before you click links, enable macros, or forward the message to colleagues.

Web upload at rookvpn.com/scan

1. Sign in to your RookVPN account (a free account is enough for daily limits).
2. Open rookvpn.com/scan.
3. Drop the saved file or use the file picker. Supported types include .eml, .msg, .pdf, .docx, .html, and common installer extensions listed on the page.
4. Wait for the AI pipeline to finish. The page shows VERDICT, WHY, and WHAT TO DO sections.
5. If the verdict is suspicious or malicious, do not open the original on a production machine; report it through your organization’s process.

Privacy note: Scan artifacts are kept only for a short operational window, then removed. Do not upload content you are not willing to share with an automated analyzer.

Forward to [email protected]

When you cannot save a file safely (mobile mail client, locked-down browser), forward the suspicious message to [email protected] from the same mailbox you use on the web tool. RookScan replies with the same style of verdict by email.

Limits apply per sender per day, matching the free web quota. Use forwarding when you are on a phone and want a written record in your inbox.

Interpreting results

• Safe: No strong phishing or malware indicators; still apply normal caution for financial requests.
• Suspicious: Mixed signals — look-alike domains, urgency language, or risky attachments without a definitive signature.
• Malicious: Strong indicators of credential harvesting, known scam patterns, or dangerous payloads.
• Unknown: The model could not classify confidently; treat as suspicious and escalate.

Always compare embedded URLs in the report with known-good bookmarks instead of clicking from the original message.

Related tools

• VPN leak testing guide — verify your VPN before browsing sensitive links
• RookSecret one-time secrets — share IOCs or passwords without leaving them in chat logs
• RookCheck WebRTC test — confirm browser metadata is not leaking while you investigate

Check the result

Read the host of each link before you read the score. A lookalike domain is enough to stop, even if the rest of the email uses a real logo. Do not click the original to confirm the report. Type the service from a bookmark if you still need to log in.

A PDF with a launch action or a link is the same decision on the PDF page. Forward the findings, not a live copy of the lure that a colleague can click.