.ics / Calendar Invite Inspector
Calendar invites are a growing phishing channel: a Teams or Microsoft 365 “re-validate your mailbox” invite lands in your calendar, and one link points at a page that steals your password. Paste the .ics file's text or the raw source of the invite / email and this tool parses the fields and flags the signals that matter — a Microsoft-login look-alike domain, link text that disagrees with its real destination, an organizer domain that doesn't match the sender, out-of-band join URLs, raw-IP or punycode hosts, and shorteners or open redirects. It is defensive only — it explains what it found and what to do, and it never generates a lure. Everything runs in your browser; nothing is uploaded, and the checks are honest heuristics, not a guarantee.
Everything runs in your browser. Nothing is uploaded, no network or WHOIS call is made. Defanged URLs (hxxps://, [.]) are re-fanged in memory only, to be analysed.
Exactly which checks run (all heuristic, no network)
- Link text vs. destination — Compares the visible text of an HTML link against the domain it actually points to.
- Microsoft-login look-alike — Flags hosts that carry Microsoft/Office/Teams/login branding but are not on the genuine-Microsoft allow-list.
- Organizer vs. sender domain — Checks whether the ORGANIZER address and the From/Sender address share a registrable domain.
- External action URL — Flags links that leave both the organizer’s domain and the known conferencing providers.
- IP / punycode / sub-domains — Flags raw IP hosts, punycode (xn--) homograph hosts, and deeply nested sub-domains.
- Shorteners / open redirects — Flags known URL shorteners and redirect-parameter patterns that hide the final destination.
These are heuristics, not a verdict of safety. The tool makes no WHOIS, DNS, or domain-age request — checking how recently a domain was registered needs an external lookup (e.g. a WHOIS service), which you can run yourself on any host flagged above.
What this tool is
- A free, 100% in-browser inspector for calendar invites: paste a .ics file’s text or the raw source of a meeting invite / email and it parses the fields and flags phishing-risk signals. Nothing is uploaded and there are no server, WHOIS or domain-age calls.
- It is defensive only. It analyses and explains an invite you received; it never generates lures, sign-in pages, or any attacker content.
- A small hand-written parser reads VCALENDAR / VEVENT fields — ORGANIZER, URL, LOCATION, DESCRIPTION, ATTENDEE, SUMMARY — and also extracts URLs plus From/Organizer lines from a raw email-ish paste.
- Six heuristic checks run: link text vs. real href, Microsoft-login look-alike domains (against a genuine-Microsoft allow-list), organizer-vs-sender domain mismatch, external join URLs, raw-IP / punycode / deep sub-domains, and URL shorteners / open-redirect patterns.
- Output is a verdict — Looks legit / Suspicious / High risk — with every signal explained, what to do next (verify before you sign in, don’t trust Microsoft branding, prefer passkeys), and a one-click Markdown export. Two example pastes (one benign, one obviously phishy with defanged URLs) let you try it.
The domain is the truth; the branding is not
Almost every credential-phishing invite leans on the same two levers: a convincing reason to hurry (your mailbox will be suspended, re-validate today) and a link that looks like Microsoft. The inspector pulls those apart. It checks the real destination of every link against a conservative allow-list of genuine Microsoft domains, so a host that merely wears the words “microsoft”, “office”, “teams” or “login” on an unrelated registrable domain is flagged for what it is. It compares the visible text of an HTML link against where the link actually goes, because a button that reads login.microsoftonline.com while pointing somewhere else is the oldest trick in the book.
It is deliberately a heuristic tool and says so throughout. It makes no network call, so it cannot tell you a domain was registered yesterday — that needs an external WHOIS or RDAP lookup you can run on any host it flags. And a clean result is not a clearance: if an invite asks you to sign in, the right move is always to open Teams or Outlook yourself, or type the organization's address by hand, rather than following a link from the invite — and to prefer phishing-resistant sign-in (passkeys or FIDO2 keys), which can't be replayed to a look-alike site the way a typed password or a one-time code can.
Frequently asked questions
What does the .ics / Calendar Invite Inspector do?
You paste the text of a .ics file, or the raw source of a meeting invite or email, and it parses the standard iCalendar fields (ORGANIZER, URL, LOCATION, DESCRIPTION, ATTENDEE, SUMMARY) plus any URLs and From/Organizer lines, then runs six heuristic checks for common phishing tricks. It gives a verdict of Looks legit, Suspicious or High risk, explains each signal in plain language, and tells you what to do. It is a defensive analysis tool: it inspects an invite you already received and never produces phishing content of any kind.
Does anything get uploaded or sent anywhere?
No. The entire tool is client-side JavaScript running in your browser. There are no network, API, WHOIS or DNS calls, no account, and nothing you paste leaves the page. That also means the tool cannot check a domain’s age or reputation, because that would require an external lookup — it is transparent about which checks it does and does not perform.
How does it tell a real Microsoft login from a look-alike?
Genuine Microsoft sign-in only lives on a short, well-known set of domains — microsoft.com, microsoftonline.com, office.com, live.com, outlook.com, sharepoint.com and a few more. The tool checks every link host against that conservative allow-list. If a host is on it (or is a sub-domain of one), it passes. If a host instead puts “microsoft”, “office”, “teams”, “login” or similar branding in front of some other registrable domain — for example a host like login-microsoftonline.teams-verify-support.example — it is flagged as a credential-harvesting look-alike. The lesson the tool reinforces is that Microsoft styling in an email proves nothing; only the domain does.
Can I check whether the sending domain was registered recently?
Not inside this tool, by design — domain age needs an external WHOIS or RDAP lookup, and the inspector makes no network calls. For any host it flags you can run that check yourself: a WHOIS/RDAP service or your registrar’s lookup will show the creation date, and a domain registered days ago that is asking for your Microsoft password is a strong additional red flag. The tool’s transparency panel lists exactly which checks it runs and which it leaves to you.
Why defang the example and any pasted URLs?
The obviously-phishy example ships with its malicious host written in defanged form (hxxps:// and [.] instead of http:// and dots) so it cannot be clicked or resolved from the page — the tool is for learning to spot attacks, not for distributing live ones. When you paste a defanged URL, the inspector re-fangs it only in memory so it can be parsed and analysed; it never renders a clickable malicious link.