# Phishing Reporting: the Outlook add-in

> Phishing reporting Outlook add-in: one button sends a suspect email for header, link and attachment analysis; the employee sees the verdict and why.

Source: https://wahukeza.com/platform/phishing

Sense · Phishing Reporting

## One button in Outlook. A verdict with a reason.

Users are sensors too. The Report to CTI add-in sends the message (headers, body, attachments) into the same pipeline that handles every other artefact, and shows the reporter what was decided and why. Non-Exchange clients forward to a mailbox and get the same lifecycle.

Outlook add-in

## Built to be approved by your mail admin.

An Office.js task pane for Outlook on the web, new and classic Outlook for Windows, and Outlook for Mac. It asks for ReadItem and nothing else, never modifies the mailbox, authenticates with Entra SSO exchanged for a short-lived platform token, and ships both manifest formats for centralised deployment.

[Request the deployment guide](https://wahukeza.com/contact?intent=docs)

Outlook · message read · task pane

Report to CTI

Sends this message to your security team. Nothing in your mailbox changes.

report #2211 · received 09:14

Malicious(credential phishing)

Reason: link resolves to a live Microsoft 365 lookalike registered 3 days ago; DMARC fail on the claimed sender; kit signature matches 2 prior reports.

Pipeline

## From the reporter’s click to a minted indicator.

1.  01
    
    ### Report
    
    One button in Outlook, or forward-as-attachment to the report mailbox from any client.
    
2.  02
    
    ### Parse
    
    Full MIME: Received chain, Reply-To, SPF/DKIM/DMARC results, URLs, attachments, with a false-positive gate so relay IPs are never filed.
    
3.  03
    
    ### Verify
    
    URLs are probed for liveness and screenshotted; attachments go to static triage and, where a sandbox is connected, detonation. With AI Threat Analysis, a classifier names the impersonated brand and the kit.
    
4.  04
    
    ### Verdict
    
    Malicious, suspicious, benign or inconclusive, with the reason, shown to the reporter in the pane.
    
5.  05
    
    ### Learn
    
    Confirmed links and senders become indicators and reach the blocklist; the rollup feeds the phishing dashboard and the management report.
    

What the analyst sees

## A report detail page, a queue, and a rollup.

-   PhishingReports
    
    ### Queue
    
    Received → parsed → detonating → verdict → closed, with filters, bulk actions and the reporter’s channel.
    
-   PhishingReportDetail
    
    ### Detail
    
    Headers annotated, URLs with liveness and screenshot, attachments with triage and detonation results, the derived IOCs and the verdict reason.
    
-   PhishingReportRollupJob
    
    ### Rollup
    
    Reports by verdict, brand and kit over time: the phishing numbers in the management-body report, or a provider’s monthly client report.
    
-   daily limit · audit
    
    ### Abuse-resistant intake
    
    A per-reporter daily limit, an audit trail of every report and verdict, and a degraded-message path for clients without full MIME access, marked partial.
    

Phishing beyond reports

## Feeds, verification and lookalikes converge.

-   ### Dedicated phishing feeds
    
    OpenPhish, PhishTank and PhishStats flow through the same write path with a fast-aging lifecycle.
    
-   ### Verification worker
    
    Every phishing URL, from any source, is probed and classified; dead pages age out, live ones climb.
    
-   ### Brand tie-in
    
    A reported mail pointing at a lookalike of a monitored brand links the report, the lookalike and the takedown.
    

[Customers report too ### Report-a-scam, for the people you serve. Phishing Reporting is for your staff. Your customers get a public report-a-scam form and mailbox, with QR codes decoded in the browser and no name or e-mail stored (part of Brand & fraud protection).](https://wahukeza.com/platform/brand-protection): Brand & fraud protection →[Verdicts from your phone ### Inconclusive? Decide on the way in. With Mobile Notifications, a report waiting for a verdict reaches the analyst’s phone. The verdict and its reason are set from the decision board, and the reporter sees them in the pane.](https://wahukeza.com/platform/mobile#notifications): Mobile protection →

## Try it in a test mailbox.

Sideload the add-in into a test mailbox, report a real phish and read the verdict in the pane.

[Book a demo](https://wahukeza.com/contact?intent=demo)

[Next: Endpoint Intelligence](https://wahukeza.com/platform/endpoint-intelligence)