FREE PUBLIC BETA  ●  $0

MAILHAWK

Your mailbox threat-hunter. MailHawk connects to a live inbox and hunts the phishing and impersonation that already landed — sender-auth spoofing, homograph & dnstwist lookalikes, disguised links, weaponised attachments — then harvests the actors' IOCs and taps a shared threat-intelligence feed. Explainable, every finding.

Rust + egui IMAP · Gmail · MS Graph MITRE ATT&CK + CAPEC x86-64 Linux
Download via Portal → Get Free Beta Key
// detection

Four detector families. One verdict.

Atomic detectors feed a campaign-signature layer, every finding cross-referenced to MITRE ATT&CK and CAPEC. Scored 0–100, with a quarantine-first disposition and defanged IOCs throughout.

🛡️
Sender Authentication
SPF / DKIM / DMARC analysis, envelope-vs-header mismatch, display-name impersonation, reply-to divergence, and authority spoofing (gov / bank from freemail).
🔤
Lookalike Domains
Unicode homograph skeletons, punycode/IDN, typosquats, and a full dnstwist-style variation engine with active resolution to surface live squatter infrastructure.
🔗
Link & Attachment Forensics
Anchor-vs-href mismatch, IP-literal URLs, shorteners, download/repo lures, plus attachment analysis (double-ext, macros, containers, HTML smuggling).
🎯
Campaign Signatures
Higher-order patterns over the atomic findings — flagship Fake-Recruiter (DPRK-style "run our coding task on your PC"), BEC/wire-fraud, and credential-harvest lures.
📒
Deduplicating IOC Ledger
One row per indicator with corroboration counts, RDAP domain-age & key-gated enrichment (AbuseIPDB / VirusTotal / Shodan), and a derived confidence score.
🌐
Shared Threat Feed
Every licensed MailHawk reads and contributes to a private, deduplicated IOC feed — the network catches the actor once and warns everyone else.
// get started

Hunting in four steps.

STEP 01
Get your key
Request a free beta key above — it lands in your inbox in seconds.
STEP 02
Install
Download & extract the tarball, then drop the key in ~/.config/mailhawk/license.key.
STEP 03
Connect a mailbox
Add an IMAP account or sign in with Gmail / Microsoft via mh-gui.
STEP 04
Hunt
Run mh hunt --account work or click Hunt in the GUI. Review verdicts, IOCs, and shared-KB hits.
MailHawk · No Hat Hacker · Adamantware OU · Authorised use only · Customer Portal