hoptrace-forensics

Inspiration

Email-based cyberattacks are becoming increasingly sophisticated, targeting educational institutions, students, government organizations, and financial departments. Traditional spam filters often fail to identify advanced phishing, domain impersonation, and business email compromise attacks.

We wanted to build a platform that goes beyond simply identifying spam. Our goal was to help institutions investigate suspicious emails, trace their network origins, understand attack techniques, and preserve reliable digital evidence.

What it does

HopTrace Forensics is an AI-powered email threat detection and digital forensic intelligence platform.

It provides multiple layers of email security analysis:

• Traces Received headers to investigate email transmission paths and identify suspicious external IP addresses.
• Uses IP geolocation to identify approximate locations, countries, network providers, and suspicious VPN or Tor connections.
• Detects internationalized domain name spoofing and visually similar malicious domains.
• Verifies SPF, DKIM, and DMARC email authentication protocols.
• Uses AI-based behavioral analysis to identify phishing language, extortion attempts, impersonation, and social engineering tactics.
• Automatically defangs suspicious URLs to reduce accidental exposure.
• Calculates a composite threat score to classify email risk.
• Generates SHA-256 and SHA-512 evidence hashes and supports blockchain-based evidence integrity tracking.
• Provides forensic reports to support institutional cyber investigations.

How I built it

We developed HopTrace Forensics using Python 3.11 and FastAPI for the backend, with HTML, CSS, and JavaScript for the frontend.

The platform is organized into specialized modules for email parsing, network and geolocation analysis, authentication verification, AI threat detection, domain spoofing detection, campaign correlation, and digital evidence management.

We integrated a multi-layer analysis pipeline that processes uploaded email files, extracts forensic information, examines authentication records, identifies suspicious behavior, and calculates a final threat score.

For evidence integrity, we implemented cryptographic hashing and blockchain anchoring using Polygon PoS.

We also added application security measures, including input size restrictions, HTML escaping, security headers, and bounded in-memory case storage.

Challenges I ran into

One of the biggest challenges was accurately analyzing complex email headers and distinguishing trustworthy Received header information from potentially forged entries.

Other challenges included detecting visually similar domains, validating multiple email authentication protocols, combining different threat indicators into a meaningful risk score, and handling suspicious email content securely.

Integrating AI-based threat analysis with traditional forensic techniques while maintaining performance and protecting sensitive evidence was another important challenge.

Accomplishments that I'm proud of

We successfully developed a multi-layer email forensic platform that combines cybersecurity, AI-based threat analysis, network intelligence, and blockchain-based evidence integrity.

We are particularly proud of:

• Building a reverse email header traversal engine.
• Implementing IDN homoglyph and phishing detection.
• Combining SPF, DKIM, and DMARC verification.
• Developing contextual AI threat analysis and risk scoring.
• Creating six demonstration investigation scenarios covering phishing, impersonation, credential theft, business email compromise, malicious attachments, and legitimate email.
• Implementing cryptographic evidence hashing and blockchain anchoring.
• Adding application security protections to strengthen the platform.

What I learned

Through this project, we gained practical experience in email security, digital forensics, network analysis, Python backend development, AI-based threat detection, and blockchain integration.

We also learned how to analyze email authentication mechanisms, investigate suspicious network paths, identify social engineering techniques, and protect sensitive forensic information.

Most importantly, we learned how different cybersecurity technologies can work together to address real-world threats against institutions.

What's next for HopTrace Forensics

Our future goal is to transform HopTrace Forensics into a scalable cyber intelligence platform for educational institutions and government organizations.

We plan to:

• Integrate real-time threat intelligence feeds.
• Improve AI-based phishing and impersonation detection.
• Expand malicious URL and attachment analysis.
• Develop campaign correlation to identify related attacks across institutions.
• Improve geolocation and network attribution capabilities.
• Strengthen blockchain-based evidence verification.
• Introduce multi-user access, institutional case management, and centralized security monitoring.
• Develop integrations with institutional email systems and Security Operations Centers.

Our vision is to help institutions detect, investigate, and respond to email-based cyber threats through a unified forensic intelligence platform.

Built With

• css
• html
• javascript
• procfile
• python