Back to Projects

AI-Phishing-Email-Analyzer

AI-powered phishing email analyzer for .eml files - Detect phishing attempts, analyze headers, URLs, attachments, and get AI-powered risk assessments

aicyber-securitycybersecurityemail-analyzeremail-securityeml-analyzerinformation-securitymachine-learningphishingphishing-detectionpythonsecurity-analysissecurity-researchsecurity-toolsthreat-detection
View on GitHubDownload ZIP
0
Stars
0
Forks
0
Watchers
0
Open Issues

README.md

# AI Phishing Email Analyzer

[![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
[![Python](https://img.shields.io/badge/python-3.8+-green.svg)](https://www.python.org/)
[![Version](https://img.shields.io/badge/version-1.0.0-orange.svg)](https://github.com/JuttSahib1999/AI-Phishing-Email-Analyzer)

## 🚨 Overview

**AI Phishing Email Analyzer** is a powerful, free, and open-source tool designed to analyze `.eml` email files for phishing indicators using AI-powered analysis. It provides comprehensive security assessments, risk scores, and actionable recommendations.

### Key Features

- 📧 **Email Parsing**: Extract headers, body, attachments, and URLs from `.eml` files
- 🎯 **Header Analysis**: Check SPF, DKIM, DMARC, and identify suspicious headers
- 🔗 **URL Analysis**: Detect malicious URLs, check redirects, and domain reputation
- 📎 **Attachment Analysis**: Identify suspicious file types, malware indicators, and extract hashes
- 🤖 **AI-Powered Analysis**: Generate risk scores, phishing probabilities, and reasoning
- 🛡️ **Sender Reputation**: Check domain age, DNS records, and blacklist status
- 📊 **Comprehensive Reports**: Generate detailed JSON and HTML reports
- 🔍 **Indicators of Compromise**: Extract and list all potential IOCs
- 📝 **Actionable Recommendations**: Get clear guidance on handling suspicious emails

## 🚀 Quick Start

### Installation

1. **Clone the repository**
   ```bash
   git clone https://github.com/JuttSahib1999/AI-Phishing-Email-Analyzer.git
   cd AI-Phishing-Email-Analyzer

   ```

2. **Install dependencies**
```bash
pip install -r requirements.txt

```


3. **Run the analyzer**
```bash
python src/main.py path/to/suspicious_email.eml

```



### Windows 10 Setup

1. Download and install Python 3.8+ from [python.org](https://www.python.org)
2. Open Command Prompt as Administrator
3. Navigate to the project directory
4. Run the setup script:
```cmd
run.bat

```



### 📋 Usage Examples

**Basic Usage**

```bash
python src/main.py sample_phishing.eml

```

**Advanced Options**

```bash
python src/main.py suspicious_email.eml --output ./reports --verbose

```

**Example Output**

```text
============================================================
ANALYSIS SUMMARY
============================================================
Subject: Urgent: Account Security Alert
Sender: security@fake-bank.com
Risk Score: 85/100
Risk Level: High
Phishing Probability: 92%
------------------------------------------------------------
Indicators of Compromise:
  • Suspicious URL: [http://fake-bank-verify.com/login](http://fake-bank-verify.com/login)
  • Suspicious attachment: invoice_123.exe
  • Suspicious domain: fake-bank.com
------------------------------------------------------------
Recommendations:
  • HIGH RISK: Do NOT open any attachments or click any links
  • Delete this email immediately
  • Report as phishing to your IT security team
============================================================
Full report saved to: output/phishing_report_20260704_120000.json

```

### 📊 Report Example

The tool generates comprehensive reports in JSON format:

```json
{
  "report_metadata": {
    "generated_at": "2026-07-04T12:00:00.123456",
    "analyzer_version": "1.0.0",
    "analyzer_author": "Abdul Muqeet Tabraiz"
  },
  "risk_assessment": {
    "overall_risk_score": 85,
    "risk_level": "High",
    "phishing_probability": 92,
    "ai_reasoning": "Contains 2 suspicious URL(s) | SPF check failed | High risk: Multiple phishing indicators detected"
  }
}

```

### 🏗️ Architecture

```text
┌─────────────────────────────────────────────────────┐
│                    Email Parser                     │
│                     (.eml file)                     │
└────────────────────────┬────────────────────────────┘
                         │
┌────────────────────────▼────────────────────────────┐
│                Analysis Components                  │
├─────────────────────────────────────────────────────┤
│  • Header Analyzer    • URL Analyzer                │
│  • Attachment Analyzer • Reputation Checker         │
└────────────────────────┬────────────────────────────┘
                         │
┌────────────────────────▼────────────────────────────┐
│                     AI Analyzer                     │
│            (Risk Scoring & Reasoning)               │
└────────────────────────┬────────────────────────────┘
                         │
┌────────────────────────▼────────────────────────────┐
│                 Report Generator                    │
│                (JSON & HTML Reports)                │
└─────────────────────────────────────────────────────┘

```

### 🔧 Dependencies

* Python 3.8+
* `requests`: HTTP requests for URL checks
* `python-magic`: File type detection
* `dnspython`: DNS record queries
* `python-whois`: Domain registration information
* `scikit-learn`: Machine learning for enhanced detection

### 🧪 Testing

#### Test on Windows 10

1. **Create a test email file:**
* Open Notepad
* Copy and paste a phishing email sample
* Save as `test_sample.eml`


2. **Run the test:**
```bash
python src/main.py test_sample.eml --output ./test_results

```


3. **Verify results:**
* Check the output directory for JSON reports
* Review the analysis summary in the console



#### Sample Test Email

```text
From: security@fake-bank.com
To: user@example.com
Subject: Urgent: Account Security Alert

Dear valued customer,

We have detected unusual activity in your account. 
Please verify your identity immediately:

[http://fake-bank-verify.com/account](http://fake-bank-verify.com/account)

If you do not respond within 24 hours, your account will be suspended.

Sincerely,
Security Team

```

### 🛠️ Development

#### Project Structure

```text
AI-Phishing-Email-Analyzer/
├── src/                    # Source code
│   ├── main.py            # Main application
│   ├── email_parser.py    # Email parsing
│   ├── header_analyzer.py # Header analysis
│   ├── url_analyzer.py    # URL analysis
│   ├── attachment_analyzer.py # Attachment analysis
│   ├── ai_analyzer.py     # AI analysis
│   ├── reputation_checker.py # Sender reputation
│   └── report_generator.py # Report generation
├── tests/                  # Test files
├── output/                 # Generated reports
└── requirements.txt        # Dependencies

```

#### Running Tests

```bash
pytest tests/

```

#### Code Style

```bash
black src/
flake8 src/
mypy src/

```

### 🔒 Security Considerations

* **No External APIs:** All analysis is performed locally
* **No Data Storage:** Email content is not stored permanently
* **No Network Calls:** Optional, configurable for enhanced security
* **Open Source:** Full transparency in security analysis

### License

This project is licensed under the MIT License - see the LICENSE file for details.

### Author

**Abdul Muqeet Tabraiz**

* LinkedIn: [@abdul-muqeet-tabraiz](https://www.linkedin.com/in/abdul-muqeet-tabraiz/)
* GitHub: [@JuttSahib1999](https://github.com/JuttSahib1999)

### 🤝 Contributing

Contributions are welcome! Please read CONTRIBUTING.md for details.

### ⭐ Support

If you find this tool useful, please give it a ⭐ on GitHub!

### 📝 Changelog

See CHANGELOG.md for version history.

### 🔗 Links

* [GitHub Repository](https://github.com/JuttSahib1999/AI-Phishing-Email-Analyzer)
* [Documentation](https://github.com/JuttSahib1999/AI-Phishing-Email-Analyzer/wiki)
* [Issue Tracker](https://github.com/JuttSahib1999/AI-Phishing-Email-Analyzer/issues)

```

```