An application and system for inspecting an email message to determine if the email message is being used in a phishing ploy. When an email recipient receives an email message, the email message is sent to an EScam server for inspection. During its inspection, the EScam server considers various criteria, such as an originating country for an IP address associated with a sender of the email message, and assigns a score to the email message. Based on the score of the email message and threshold levels set within the EScam server, an email client determines whether the email message is part of a phishing ploy or a legitimate email message.