01
Preserve Evidence
Your original message is captured exactly as it arrived — headers, routing and all — so nothing is lost to a forward or a screenshot.
Received a suspicious email?
Turn It Into Evidence — Not Guesswork.
ScamPursuit helps you preserve the original message, understand what is happening behind it, trace technical indicators, prepare appropriate reports, and keep the entire pursuit organized in one case.
Upload it once. We analyze it, trace it, report it, and track it.
No obligation. Your original evidence stays yours.
Pursuit IntakePreview
Drop a suspicious email here.
We keep the original file untouched so it stays usable as evidence.
.eml · .msg · forwarded message
Your original evidence is preserved.
Already clicked, paid, installed something, or shared information?
Get immediate safety guidanceWhat you get
Don't Just Delete It. Pursue It.
Deleting a scam email protects you for a day. Preserving what it contained and routing it to the right place is what actually makes it cost the sender something.
02
Understand the Threat
What the message is trying to do, written in plain language. No jargon dump, no guesswork about what you're looking at.
03
Trace Technical Indicators
Originating IP, sending and reply-to domains, authentication results, embedded links and attachments — traced and mapped.
04
Prepare Reports
ScamPursuit identifies the appropriate reporting destinations and prepares the evidence for review, so you're not starting from a blank page.
05
Track the Pursuit
One organized case — analysis status, recommended reports, documentation and everything you've filed — kept in one place.
The workflow
One Email. One Pursuit.
Four stages, one case file. You stay in control of what gets shared and with whom — ScamPursuit keeps the trail intact behind it.
- 01
Upload or Forward
Send the original message — as a file or a forward. The raw source is captured before anything is opened.
Raw source captured
- 02
Analyze
Headers, domains, IPs, authentication results, links and attachments are examined and explained in plain language.
Indicators mapped
- 03
Pursue
ScamPursuit identifies appropriate reporting destinations and packages the evidence for review.
Reports prepared
- 04
Track
Every finding, report and action stays organized in a single case you can return to at any time.
Case kept current
Pursuit report
What a completed analysis looks like.
A case file that reads like a finding, not a log dump — every indicator explained, and every recommended report attached to it.
Case SP-000124
Analysis CompleteExample Data
Assessment
Strong indicators of fraudulent activity
The sending domain does not authenticate, the reply-to address routes to an unrelated free mail provider, and the embedded link redirects through a cloaked intermediary. Treat any interaction with this message as unsafe.
Technical findings
- Originating IP
- 185.xx.xx.42
- Sending Domain
- secure-billing-portal.co
- Reply-To Domain
- mail-recovery-inbox.com
- SPF Status
- FAIL — domain does not authorize sender
- DKIM Status
- NONE — no valid signature present
- DMARC Status
- FAIL — policy p=none, no alignment
- URLs Found
- 3 extracted · 1 cloaked redirect
- Attachments
- 1 file · invoice_0924.html
- Related Domains
- 2 registered within 14 days
- IP Addresses
- 185.xx.xx.42 · 104.xx.xx.19
- SHA-256 Fingerprint
- 9f2c…a41e (full hash in report)
Recommended routing
Sending-domain registrar
Abuse contact · evidence bundle attached
Hosting provider
Originating IP abuse desk
Brand impersonated
Fraud / phishing intake
Evidence integrity
Original message preserved unmodified and fingerprinted at intake.
Detection is only the beginning
Most tools stop at the warning.
A scanner tells you something is wrong and closes the tab with it. ScamPursuit bridges the gap between identifying a suspicious email and organizing evidence-based action — the eight steps in between that nobody else does for you.
Detection answers “is this bad?” ScamPursuit answers “what do I do with it now?”
DETECT
Recognize the fraud signals in the message.
EXPLAIN
Say what they mean in plain language.
PRESERVE
Keep the original evidence intact.
TRACE
Follow domains, IPs and links.
ROUTE
Find the right destination to report to.
PACKAGE
Assemble evidence the way reviewers expect.
DOCUMENT
Record what was found and what was filed.
FOLLOW
Keep the pursuit organized over time.
Security & privacy
Suspicious Email Can Contain Sensitive Information.
Scam looks have a way of arriving in the same inbox as your bank statements and account notices. We treat the message as evidence — handled carefully, disclosed only where you intend it to go, and never treated as something to casually open and click through.
Evidence Isolation
Suspicious content is handled apart from everything else, so a scam email never touches the rest of your case.
Controlled Disclosure
You decide what is shared and with whom. Nothing leaves your case without your direction.
Evidence Integrity
The original message is preserved unmodified and fingerprinted at intake, so its authenticity holds up.
Safe Analysis
Links and attachments are examined without being executed in a way that puts you at risk.
Human Review
Automated indicators are reviewed and explained before anything is packaged as a finding.
Clear Attribution
Findings are attributed to what was actually observed — no overstating, no implied certainty.
Independence
Built to Pursue Fraud. Not Pretend to Be the Police.
ScamPursuit is an independent, consumer-focused service. We are not affiliated with law enforcement, and we are not a government agency. We don't have badges, we don't make arrests, and we won't tell you we can.
What we do is give you an organized, well-prepared case — so that when it does reach someone who can act, it arrives as evidence rather than a forwarded email.
We do not guarantee
- Takedowns of websites, listings or domains
- Prosecution or any legal outcome
- Account suspension by any provider
- Recovery of money you have already sent
- A response from any provider or authority
Outcomes depend on the providers, platforms and authorities you report to. Our job is to make sure what you send them is complete, accurate and ready to review.
Don't Just Delete the Next Scam.
Pursue It.
Upload it once · We analyze it, trace it, report it, track it