Phishing Analysis Toolkit
Overview
I built this tool because phishing analysis follows the same pattern every time. You get a suspicious email forwarded to you, and the first 15 minutes are always the same: check the headers, look for From/Reply-To mismatches, verify SPF/DKIM/DMARC, pull out the URLs, check for sketchy attachments, and decide if it’s worth escalating. That’s a workflow that should be automated.
The Phishing Analysis Toolkit takes a raw .eml file and runs it through a full analysis pipeline, producing a structured report with a risk score.
What It Does
The analyzer runs seven checks against every email:
Header analysis. Extracts From, To, Reply-To, Return-Path, X-Mailer, and the full Received chain. Flags mismatches between the From domain and Reply-To or Return-Path domains, which is one of the most common indicators of a spoofed sender. Also catches suspicious mail clients like PHPMailer or Python-based senders that don’t belong in legitimate corporate email.
Authentication verification. Parses the Authentication-Results header for SPF, DKIM, and DMARC pass/fail status. Triple failure on all three is a strong phishing signal.
IOC extraction. Pulls URLs, IP addresses, domains, and file hashes (SHA256, MD5) from the email body using regex pattern matching. Flags URL shorteners (bit.ly, tinyurl, t.co) and IP-based URLs, both of which are common in phishing campaigns trying to obscure the real destination.
Urgency detection. Scans the subject line and body for social engineering keywords: “urgent,” “action required,” “suspended,” “verify your account,” “within 24 hours.” These are the pressure tactics that make phishing work. The more urgency keywords found, the higher the risk score.
Attachment analysis. Checks every attachment for dangerous file extensions (.exe, .ps1, .bat, .iso, .lnk, etc.) and generates SHA256 and MD5 hashes for each file. The hashes can be checked against threat feeds like VirusTotal for known malware.
Risk scoring. Every finding contributes to a 0-100 risk score. Header mismatches, authentication failures, IP-based URLs, urgency language, and dangerous attachments all add points. The final score maps to a severity level: LOW, MEDIUM, HIGH, or CRITICAL.
Reporting. Outputs a formatted terminal report or raw JSON for integration with other tools. Reports can be saved to disk for documentation.
Example Analysis
Running the toolkit against a sample phishing email:
1
python analyzer.py samples/sample_phish.eml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
============================================================
PHISHING ANALYSIS REPORT
============================================================
Risk Level: CRITICAL (Score: 100/100)
From: IT Security Team <security@c0mpany-alerts.com>
To: employee@company.com
Subject: URGENT: Your Account Has Been Compromised
Reply-To: support@totallylegit-security.com
Hops: 0
SPF: fail
DKIM: fail
DMARC: fail
URLs Found: 3
- https://192.168.45.12/verify?token=abc123
- https://bit.ly/3xF4kEd
- https://c0mpany-portal.security-verify.com/login
Urgency Keywords: urgent, immediate, action required, suspended,
verify your account, unauthorized, disabled,
unusual activity, compromised, act now, within 24 hours
Attachments: 1
- security_update.exe (24 bytes) [SUSPICIOUS]
Findings (10):
[HIGH] HEADER_MISMATCH: From/Reply-To domain mismatch
[MEDIUM] RETURN_PATH_MISMATCH: From/Return-Path domain mismatch
[MEDIUM] SUSPICIOUS_MAILER: PHPMailer detected
[HIGH] SPF_FAIL: SPF authentication failed
[HIGH] DKIM_FAIL: DKIM verification failed
[HIGH] DMARC_FAIL: DMARC policy check failed
[MEDIUM] URL_SHORTENER: bit.ly detected
[HIGH] IP_BASED_URL: URL uses IP address
[MEDIUM] URGENCY_LANGUAGE: 11 urgency keywords found
[CRITICAL] SUSPICIOUS_ATTACHMENT: security_update.exe
============================================================
Ten findings. Every one of them is something an analyst would have checked manually. The tool does it in under a second.
How It’s Built
The entire toolkit is written in Python using only standard library modules. No pip installs, no external dependencies. This was intentional because security tools that require a complex setup don’t get used.
The analyzer uses a builder pattern where each check method returns self, so the full pipeline chains together:
1
2
3
4
5
6
7
8
analyzer = PhishingAnalyzer('suspicious_email.eml')
analyzer.parse()
.analyze_headers()
.check_authentication()
.extract_iocs()
.check_urgency()
.check_attachments()
.calculate_risk()
Each method is independent. If you only need IOC extraction, you can call parse() and extract_iocs() without running the full pipeline.
Why This Matters
Phishing is still the number one initial access vector. Every SOC analyst spends a significant chunk of their day triaging phishing reports. A tool like this doesn’t replace the analyst, but it compresses that initial 15-minute triage into seconds and ensures nothing gets missed.
It also ties back to why I got into security in the first place. I was on the receiving end of a phishing attack, and the experience of understanding how it worked changed how I look at everything. This tool is a practical expression of that curiosity.
Tools and Skills
- Python (standard library only)
- Email protocol analysis (SMTP headers, MIME parsing)
- IOC extraction (regex pattern matching)
- Email authentication (SPF, DKIM, DMARC)
- Social engineering detection
- Risk scoring and reporting