If you run Gsuite as your email server, this is for you.
A Google Apps Script that automatically detects phishing emails that use display-name spoofing — where the sender name shows a trusted brand (e.g., "Wіх.соm" with Cyrillic characters) but the actual email comes from an unrelated domain (e.g., info@bistro-pub.de).
- Runs every 15 minutes via a time-driven trigger
- Scans your recent inbox messages
- Normalizes Unicode homoglyphs (Cyrillic, Greek, fullwidth characters) in sender display names
- Checks normalized names against a curated list of ~50 brand domains
- Compares the implied brand domain against the actual sender domain
- Flags mismatches with a SPOOF-ALERT label and a star
| Display name | Actual sender | Result |
|---|---|---|
| "Wіх.соm" (Cyrillic і and о) | info@bistro-pub.de | Spoof detected |
| "PаyPаl Security" (Cyrillic а) | alerts@some-random.com | Spoof detected |
| "Wix.com" | noreply@wix.com | Legitimate |
| "Google" | no-reply@accounts.google.com | Legitimate |
- Go to script.google.com and create a new project
- Delete the default
Code.gscontent - Create 5 files (using the + button next to "Files") with these exact names:
Code.gsHomoglyphs.gsBrands.gsSpoofDetector.gsCache.gs
- Copy the contents of each
.gsfile from this repo into the corresponding file - Replace the contents of
appsscript.json(click the gear icon > "Show appsscript.json manifest file in editor")
npm install -g @google/clasp
clasp login
clasp create --type standalone --title "Unspoofer"
clasp push- In the Apps Script editor, select
testDetectionfrom the function dropdown and click Run - Authorize the requested Gmail permissions when prompted
- Check the Execution log — all 9 test cases should show PASS
- Select
setupfrom the dropdown and click Run - Verify the SPOOF-ALERT label appears in your Gmail
The scanner is now active and runs every 15 minutes.
| File | Purpose |
|---|---|
Code.gs |
Entry points: setup(), scanInbox(), uninstall(), testDetection() |
Homoglyphs.gs |
Unicode homoglyph map (~80 chars) and normalizeToAscii() |
Brands.gs |
~50 brand domains and findSpoofedBrand() matching |
SpoofDetector.gs |
Sender parsing, root domain extraction, spoof detection logic |
Cache.gs |
Processed message ID tracking (rolling 10K window) |
appsscript.json |
Apps Script manifest with required OAuth scopes |
Run uninstall() from the script editor. This removes all triggers and clears the message cache. The SPOOF-ALERT label is preserved so you can review previously flagged messages.
- Subdomains:
mail.wix.comis recognized as legitimate wix.com - Compound TLDs:
.co.il,.co.uk,.com.auare handled correctly - Short brand names: Brands shorter than 4 characters (like "x.com") require word-boundary matching to avoid false positives
- Execution limits: Stops scanning before the 6-minute Apps Script timeout
- Quota limits: 15-minute trigger = ~96 runs/day, within the 100/day trigger limit
Labels appear as folders under your Gmail account in Apple Mail. Starred messages show up as flagged.
MIT