Enterprise phishing triage workspace
Investigate EML threats with SOC-grade clarity.
A polished analyzer for suspicious email investigations: authentication verdicts, MIME structure, macro-enabled attachments, URL risk scoring, threat intelligence, and SphereAI narrative in one analyst-ready workspace.
Local EML parsingFiles are parsed in-browser before enrichment.
No file storageUploaded EML/MSG content is not stored.
Real enrichmentVirusTotal and AbuseIPDB, no mock scores.
AI narrativeSphereAI explains intent and response actions.
Live analysis preview
87
High Risk
DMARCFAIL
AttachmentXLSM
URL Risk74%
AI Intent91%
SPF
Fail
Authentication
Hashes
2
SHA256 / MD5
Intel
4
Observables
message/rfc822
└── multipart/mixed
├── text/plain
├── text/html
└── invoice_2026.xlsm [macro]
SphereAI Signals
Phishing intentHigh
Brand spoofingLikely
SOC summaryReady
Built for
SOC Analysts
DFIR Investigators
Phishing Triage
Threat Hunters
MSSPs
Capabilities
Security signals that analysts can act on.
The landing page now mirrors the product: quiet enterprise design, meaningful indicators, and clear operational value.
Authentication Chain
SPF, DKIM, DMARC, ARC, and Received-SPF verdicts extracted from real header fields.
Attachment Forensics
Macro-enabled attachments, hashes, MIME mismatch, magic bytes, and entropy scoring.
URL & Domain Risk
Homoglyph detection, punycode, suspicious TLDs, entropy, and phishing keyword scoring.
SphereAI Narrative
Phishing intent, social engineering analysis, IOC correlation, and SOC-ready summaries.
Workflow
From raw EML to investigation package.
A compact analyst flow designed for repeated phishing triage, not a decorative marketing funnel.
1
Parse
Read headers, body, MIME parts, URLs, and attachment metadata.
2
Score
Correlate authentication, spoofing, content, URL, and attachment risk.
3
Enrich
Query configured reputation providers for IPs and domains.
4
Explain
Generate SphereAI narrative, social engineering, and analyst notes.
5
Hunt
Export SOC report and KQL queries for follow-up investigation.
Privacy by design
This app doesn't store EML/MSG files you upload. Email content is parsed locally; only observables such as IPs and domains are sent to configured enrichment APIs.