BadPhish

BadPhish adds a safety check to the links you click in Outlook on the web and Gmail. When you click an eligible link, BadPhish checks the destination on its server before your browser loads it — and stops suspicious links on a clear warning page so you can see where the link really goes and what was flagged. How it works 1. Click a link in Outlook on the web or Gmail. The extension catches the click before navigation starts. 2. BadPhish checks the URL server-side: it unwraps Safe Links and other redirect wrappers, normalizes the URL, and evaluates it with local heuristics (punycode and homoglyphs, suspicious ports, URL shorteners, encoded nested URLs, domain age, brand proximity) plus keyless threat feeds. 3. You decide. Suspicious links land on a warning page showing the destination and the findings. Going back is the primary action; proceeding is an explicit choice. Known-bad links are blocked outright. Privacy by design • The extension sends only the URL you clicked, the webmail app you clicked from, how you clicked (same tab, new tab, or new window), and the extension version — one request to badphish.app. No email content, no mailbox, no page contents, no attachments, no browsing history. • No account, no analytics, no advertising, no data selling. • Warning tokens and their URL records expire within an hour. Opt-in site access BadPhish requests no webmail host access at install. Grant access per provider (Outlook, Gmail) from the extension popup; revoke it any time from the popup or Chrome's Site access settings. Works with Chrome and Microsoft Edge (Manifest V3).