This is a command-line tool that automates the first-response workflow for phishing email investigations. You point it at a .eml file and it handles the rest — parsing headers, pulling out indicators, checking them against three threat intelligence APIs, and writing everything into a clean HTML report.
I built this to replicate what a SOC analyst actually does when a phishing alert comes in: check the headers, extract the IOCs, enrich them, and document the findings. Doing that manually across five browser tabs gets old fast.
The pipeline runs in four stages:
1. Header parsing — extracts From, Reply-To, Return-Path, Message-ID, and authentication results. Flags any mismatch between sender fields, and catches SPF, DKIM, and DMARC failures.
2. IOC extraction — regex-based extraction of URLs, public IP addresses, domain names, and file hashes from the email body and headers. Private/loopback IPs are filtered out automatically.
3. Threat intelligence enrichment — each IOC gets checked against:
- VirusTotal (URLs and IPs)
- AbuseIPDB (IPs — abuse confidence score, country, ISP)
- URLScan.io (URLs — full scan with screenshot)
4. Report generation — outputs a self-contained HTML file with a final verdict, all IOC tables, API results, and MITRE ATT&CK technique mapping.
phishing-analyzer/
├── main.py # Entry point
├── parser.py # Header parsing and spoofing detection
├── ioc_extractor.py # IOC extraction logic
├── enrichment.py # API calls to VT, AbuseIPDB, URLScan
├── report.py # HTML report generator
├── config.py # API keys — not committed
└── sample_phishing.eml # Test email
git clone https://github.com/Divy1011/phishing-analyzer.git
cd phishing-analyzerpip install requests python-whois dnspython beautifulsoup4 coloramaCreate a config.py file in the project root:
VIRUSTOTAL_API_KEY = "your_key_here"
ABUSEIPDB_API_KEY = "your_key_here"
URLSCAN_API_KEY = "your_key_here"All three are free tiers and take about five minutes to set up:
| Service | Signup | Free limit |
|---|---|---|
| VirusTotal | virustotal.com/gui/join-us | 4 req/min |
| AbuseIPDB | abuseipdb.com/register | 1,000 req/day |
| URLScan.io | urlscan.io/user/signup | 100 scans/day |
# Basic usage
python main.py sample_phishing.eml
# Custom report name
python main.py sample_phishing.eml --output investigation_001.htmlThe report saves to the same directory. Open it in any browser.
Running against the included test email:
[1/4] Parsing email headers ...
From : security-alert@paypa1-secure.com
Subject : Urgent: Your Account Has Been Compromised - Verify Now
[2/4] Checking for spoofing indicators ...
Reply-To mismatch detected
Return-Path mismatch detected
SPF FAIL
DKIM FAIL
DMARC FAIL
[3/4] Extracting IOCs ...
URLs : 2 found
IPs : 1 found
Domains: 4 found
[4/4] Enriching IOCs ...
Analysis Complete
Report : report_20260513_142823.html
Flags : 5 spoofing indicators
| Technique | Name |
|---|---|
| T1566.001 | Phishing: Spearphishing Attachment |
| T1566.002 | Phishing: Spearphishing Link |
| T1078 | Valid Accounts |
| T1204.001 | User Execution: Malicious Link |
| T1071.003 | Application Layer Protocol: Mail |
The free VirusTotal tier caps at 4 requests per minute. The enrichment module adds a 15-second delay between API calls to stay within that limit. If you upgrade to a paid key, you can lower that delay in enrichment.py.
URLScan submissions are set to private visibility by default.
Built by Divy Patel as part of a hands-on SOC home lab. The goal was to build something that mirrors a real analyst workflow rather than just running a scanner.
- Portfolio: divypatel-portfolio.netlify.app
- LinkedIn: linkedin.com/in/divypatel-7695a01ba
- GitHub: github.com/Divy1011
CompTIA Security+ | CySA+ | CSAP | AWS CLF-C02 | Microsoft Security Essentials
MIT License