$ show keraattin/EmailAnalyzer
EmailAnalyzer is a command-line application for analyzing suspicious email files (.eml). It extracts headers, links, attachments, digests (hashes), and authentication results (SPF/DKIM/DMARC) from email messages. The tool provides investigation features that generate links to threat intelligence services (VirusTotal, AbuseIPDB, URLScan) for indicators of compromise found in emails. Output can be displayed in the terminal or saved as JSON or HTML reports. The architecture is modular with separate functions for each analysis component, all depending only on the Python standard library, making them highly reusable.
The LLM identified 3 files worth highlighting for reuse:
Extracts SPF, DKIM, and DMARC authentication results from email headers. Parses both Authentication-Results and Received-SPF headers, handling cases where SPF might only be present in Received-SPF. Returns structured data with protocol results in lowercase. Demonstrates non-obvious skill in correctly interpreting email authentication standards.
Extracts URLs from both HTML (href attributes) and plain-text parts of email messages. Handles character encoding with proper fallbacks, prioritizes HTML links over plaintext URLs, strips trailing punctuation, and deduplicates results. Generates investigation links to VirusTotal and URLScan for each URL. Shows expertise in MIME email parsing and link extraction logic.
Generates self-contained HTML reports from JSON analysis data with Bootstrap 5 styling. Features include XSS protection through proper escaping, sticky navbar with section navigation, copy-to-clipboard buttons for hashes and URLs, threat level visualization, and merged tables showing data and scan links together. Demonstrates strong frontend engineering awareness with security-conscious implementation.