01 · Header Input
Paste full raw headers (Outlook: File → Properties → Internet headers / OWA: View message details)
Analysis is fully local. External reputation links (MXToolbox, VirusTotal, AbuseIPDB, Talos) only open if you click them.
Comparison
Values highlighted in amber appear in two or more of the selected investigations — shared infrastructure is a campaign indicator.