Score the change, not the appearance.
In security and spam, how something looks is a dead signal — the real invoice looks fake, and the fake one looks real. These local-first tools judge a thing by how far it deviates from your own history, not its surface. Your data never leaves your machine.
Two sensors, one engine
nodary
Connects read-only to your mailbox and learns each sender's normal behavior, then flags the message that deviates — a trusted contact suddenly acting off, a look-alike domain, a cold outreach that redirects your reply. All analysis runs on your machine. No cloud, no telemetry, ever.
Honeypot blocklist
The same engine pointed at attackers. A honeypot the Foundation operates logs real SSH/Telnet break-in attempts; a recency-scored blocklist publishes the confirmed, currently-active offenders — including the ones that broke in and ran shell commands. Original sensor data, not a re-aggregation.
The Foundation runs the infrastructure this comes from
Questions about these tools or the data? [email protected]