MailHawk

MAILBOX THREAT HUNTER

MAILHAWK

Your mailbox threat-hunter. MailHawk connects to a live inbox and hunts the phishing and impersonation that already landed — sender-auth spoofing, homograph & dnstwist lookalikes, disguised links, weaponised attachments — then harvests the actors' IOCs and taps a shared threat-intelligence feed. Explainable, every finding.

Rust + egui IMAP · Gmail · MS Graph MITRE ATT&CK + CAPEC x86-64 Linux

Download via Portal →

// detection

Four detector families. One verdict.

Atomic detectors feed a campaign-signature layer, every finding cross-referenced to MITRE ATT&CK and CAPEC. Scored 0–100, with a quarantine-first disposition and defanged IOCs throughout.

🛡️

Sender Authentication

SPF / DKIM / DMARC analysis, envelope-vs-header mismatch, display-name impersonation, reply-to divergence, and authority spoofing (gov / bank from freemail).

🔤

Lookalike Domains

Unicode homograph skeletons, punycode/IDN, typosquats, and a full dnstwist-style variation engine with active resolution to surface live squatter infrastructure.

🔗

Link & Attachment Forensics

Anchor-vs-href mismatch, IP-literal URLs, shorteners, download/repo lures, plus attachment analysis (double-ext, macros, containers, HTML smuggling).

🎯

Campaign Signatures

Higher-order patterns over the atomic findings — flagship Fake-Recruiter (DPRK-style "run our coding task on your PC"), BEC/wire-fraud, and credential-harvest lures.

📒

Deduplicating IOC Ledger

One row per indicator with corroboration counts, RDAP domain-age & key-gated enrichment (AbuseIPDB / VirusTotal / Shodan), and a derived confidence score.

🌐

Shared Threat Feed

Every licensed MailHawk reads and contributes to a private, deduplicated IOC feed — the network catches the actor once and warns everyone else.

// get started

Hunting in four steps.

STEP 02

Install

Download & extract the tarball, then drop the key in ~/.config/mailhawk/license.key.

STEP 03

Connect a mailbox

Add an IMAP account or sign in with Gmail / Microsoft via mh-gui.

STEP 04

Hunt

Run mh hunt --account work or click Hunt in the GUI. Review verdicts, IOCs, and shared-KB hits.

MailHawk · No Hat Hacker · Adamantware OU · Authorised use only · Customer Portal

Downloads & documentation on NoHatHacker →Talk to us