SELF-HOSTED

HeaderGuard

The full email or just the header from your email client: comprehensive phishing analysis with threat intelligence integration and campaign-level correlation.

Hand HeaderGuard full emails from your email client as EML, MSG, MBOX or PST files, several at once if you like, paste the raw source, or give it just the raw header block. The analysis is equally comprehensive in every case.

Traditional email clients hide almost every header, and free online analyzers return plain text extracts: no automatic threat intelligence, no campaign-level correlation.

HeaderGuard unifies all of it in a single Docker-based, self-hosted platform. True Origin IP discovery, SPF, DKIM, DMARC and ARC checks, homoglyph detection, AI psycho-linguistic analysis, campaign-level case management and NIS2 incident documentation.

Key features

Automatic True Origin IP. Bottom-up traversal, private IP filtering, MaxMind geolocation and an interactive world map.
SPF, DKIM, DMARC and ARC at once. Live DNS lookups, with header auth results checked against the actual DNS record.
Homoglyph and Unicode spoofing detector. More than 60 confusable character pairs, Levenshtein brand matching, IDN and Punycode.
Threat intelligence integration. VirusTotal, AbuseIPDB, PhishTank, URLScan.io, Pulsedive, EmailRep, HIBP, DNSBL and domain age (RDAP).
AlienVault OTX APT attribution. APT groups, malware families, MITRE ATT&CK techniques and campaign names.
Links and attachments. Resolves URL shorteners and SafeLinks rewrites, detects Office macros, MIME mismatches and PDF links.
Quishing detector. QR codes in PNG and JPG attachments are decoded and the extracted URLs go through the threat intelligence checks.
Rule-based phishing engine. Hungarian and English patterns: urgency, credential requests, financial lures, 27 brands, fake sender names.
AI psycho-linguistic analysis. A local Ollama or LM Studio model streams in real time, flagging signs of manipulation.
Timing anomaly and crypto wallet detector. Backward timestamps, delays of more than two hours between hops, BTC and ETH addresses.
Case management and correlation. Campaign-level and linked cases, 2D and 3D node graphs and a correlation report.
Reports and export. PDF report, NIS2 incident documentation, IoC export in CSV and MISP formats, full JSON export.
Enterprise operation. User roles, offline signed licensing, encrypted API keys, a source-free image, Hungarian and English UI.