MailMapr

Built for professionals who handle email evidence

Whether you're investigating phishing, auditing communications, or simply need to open email files

Cybersecurity Analysts

Investigate phishing attacks, detect spoofing, identify IoCs and compromised accounts.

Legal & Compliance

Review email evidence with chain-of-custody. Export forensic reports for legal proceedings.

IT Administrators

Open and view EML/MSG files. Convert between formats. Analyze suspicious emails from users.

View Any Email File

Open EML, EMLX, MSG (Outlook), and MBOX archives without any email client installed. View full message body, headers, attachments, and metadata.

Quick View mode — open and inspect email files without creating a project.

Export & Convert

Export email evidence to PDF for sharing with teams, legal departments, or management. Generate professional forensic reports in HTML and PDF formats.

Batch analysis — import multiple files at once via drag & drop.

.eml .emlx .msg .mbox → PDF → HTML

Phishing Detection

Automatic risk scoring (0–100) per email. Detect header spoofing, domain mismatches, authentication failures (SPF, DKIM, DMARC), and suspicious patterns.

Trust Color Coding

Emails, domains, and IPs color-coded by trust: green (whitelist), orange (suspicious), red (blacklist). Instant visual threat assessment.

Timeline Analysis

Visualize email communication patterns over time. Identify anomalies, timeline gaps, and correlate events across an incident.

Network Graph

Map communication relationships between all addresses. Detect communities, identify attack hubs and entry vectors visually.

Indicators of Compromise

Track malicious emails, domains, and IPs as IoCs. Record threat level, source, and occurrences. Export for threat intelligence sharing.

Professional Reports

Generate Technical Forensic and Executive Summary reports. Full email analysis, risk breakdown, trust distribution, and per-incident details.

Cross-Incident Correlation

Identify recurring contacts across multiple investigations. Detect coordinated attacks spanning different cases and timeframes.

Privacy First

100% offline analysis. No data leaves your Mac. No cloud, no accounts, no tracking. App Sandbox protected. Your evidence stays yours.

Project Dashboard Risk distribution, trust analysis, threat vectors, flagged senders, and IoC tracking at a glance.

Global Dashboard Cross-project analysis with incident timeline, risk scores, and cross-incident contact correlation.

Correlation — Email Network Interactive network graph mapping sender relationships. Color-coded by trust level with centrality metrics.

Correlation — Threads Visualize conversation threads as interactive graphs. Related emails are linked automatically, revealing reply chains, forwarding patterns, and connections between incidents.

Timeline Analysis Visualize email threads over time. Inspect individual messages with phishing tags, body preview, and full metadata.

Message & Headers Full header analysis with parsed fields, SPF/DKIM/DMARC results, IP addresses, and authentication details.

Indicators of Compromise Track and tag malicious emails, domains, and IPs. Add IoCs with threat level, notes, and associated evidence.

Professional Reports Generate Technical Forensic and Executive Summary reports with email activity timeline and thread network visualizations.

Ingest & Email Viewer Import emails via drag & drop. View message body, headers, raw content, and metadata with phishing tags.

Import Investigation Data Import trust lists, evidence tags, IoC index, and marks from another project with merge or replace options.

Export Investigation Data Export trust lists, evidence tags, IoC index, and message marks for sharing or archiving.

Home & Workspace Workspace overview with project list, incident timeline, Quick View for instant file inspection, and project creation.

All email addresses, company names, and domains shown in screenshots are entirely fictitious and created for demonstration purposes using the IANA-reserved .test TLD.

Create a Project

Organize your investigation by creating a project. Each project keeps evidence, analysis, and reports separate and self-contained.

Import Evidence

Drag and drop EML, MSG, or MBOX files into the Ingest module. MailMapr parses headers, body, attachments, and metadata automatically. Use Quick View to inspect files without a project.

Analyze & Investigate

Review phishing risk scores, SPF/DKIM/DMARC results, and trust color coding. Use Timeline, Correlation graphs, and Indicators to map the full attack picture.

Generate Reports

Export Technical Forensic or Executive Summary reports as HTML or PDF. Share findings with management, legal teams, or incident responders.