AI Email threat Detection,GeoLocation and Forensic Platform

login page
dashboard
analyzing email page by uploading an .eml file
email integration possible directly
analyzing email and giving a risk score according to it
geolocation and generating a forensic report
total no of cases and there detailed study is given here
alert section
auto block account if risk score is greater than 75
keep the same email account together

Inspiration

Every day, companies, banks, and universities lose billions of dollars to clever email scams, fake CEO messages (Business Email Compromise), and phishing attacks. Traditional spam filters only look for obvious junk words and miss advanced scams. When a suspicious email arrives, security analysts have to spend 30 to 45 minutes manually reading technical headers and running separate network lookups. We were inspired to build Sentinel—an automated platform that acts like a digital forensic investigator, analyzing the entire email, tracking the sender’s location, and detecting threats in under 5 seconds

What it does

Deep Header & Protocol Inspection: Checks if the sender's identity is verified using cryptographic standards (SPF, DKIM, and DMARC) and detects forged server hops. Origin Geolocation & Map Display: Extracts the real sender IP address, pinpoints it on an interactive world map, and detects if it was sent through Tor, a VPN, or a proxy server. Hybrid AI Fraud Detection: Combines fast pattern-matching rules (for urgency words and fake bank requests) with LLMs (Groq & Gemini) to calculate an explainable 0–100 Fraud Score. Campaign Clustering: Automatically groups separate attack emails that share the same hacker IP, domain, or malicious link into a single Threat Campaign. Police-Ready PDF Evidence: Creates formal, downloadable forensic PDF reports with an immutable Chain-of-Custody log ready for cyber crime reporting. Live Gmail Connection: Connects securely to Google accounts via OAuth2 to scan and analyze inbox emails with one click.

How we built it

Frontend (UI): Built with React 18, Vite, and Tailwind CSS to create a fast, dark-mode cybersecurity dashboard with interactive OpenStreetMap views. Backend Gateway: Powered by Node.js and Express.js to manage REST APIs, user authentication, Google OAuth2, and PDF report generation. Database & Security: Uses PostgreSQL (Supabase) with strict Row-Level Security (RLS), ensuring complete user privacy and data isolation. Forensic & AI Engine: A specialized Python FastAPI microservice using mail-parser, dnspython, python-whois, and LLM APIs (Groq gpt-oss-20b and Google Gemini)

Challenges we ran into

Slow Network Lookups: Checking IP geolocation, domain WHOIS age, DNS records, and Tor lists one by one originally took 10–15 seconds. We solved this using Python multithreading and async fan-out, running all network checks at the exact same time in parallel to finish in < 2 seconds. Preventing AI Mistakes (Hallucinations): LLMs can sometimes flag a real, urgent email as fake. We solved this with a Cryptographic Trust Hierarchy—if an email passes all cryptographic checks (SPF/DKIM/DMARC), the AI's penalty points are strictly capped. Data Privacy: Storing private emails safely was critical. We created Role-Based Data Masking so standard viewers only see masked addresses (j***@company.com), while investigators see full technical data

Accomplishments that we're proud of

Reducing forensic triage time by 95% (from 45 minutes down to 2 seconds). Building an algorithm that detects relay timestamp forgery (spotting time reversals in email server hops). Making the Fraud Score 100% explainable so analysts know the exact mathematical reasons behind every score. Achieving a seamless, working one-click Gmail inbox integration

What we learned

How email protocols (SMTP, RFC 822, SPF, DKIM, DMARC) work under the hood. How to combine deterministic rules with generative AI without false alarms. Implementing Zero-Trust database security using PostgreSQL Row-Level Security policies. Managing high-concurrency background threads in Python FastAPI

What's next for AI Email threat Detection,GeoLocation and Forensic Platform

Microsoft 365 Integration: Adding support for Outlook and corporate Exchange servers via the Microsoft Graph API. Commercial Threat Feeds: Connecting live enterprise threat intelligence like MaxMind GeoIP2 and GreyNoise. Automated SOAR Webhooks: Adding one-click buttons to instantly quarantine emails and block malicious IP addresses across the entire organization. Specialized On-Device AI Models: Fine-tuning lightweight open-source models trained specifically on real-world Indian cyber crime data