PHISH-TRACE AI

From Suspicious Email to Actionable Evidence

Comment

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for PHISH-TRACE AI

Inspiration

Phishing remains one of the most common entry points for cyber incidents, but analyzing a suspicious email often requires manually reviewing headers, URLs, attachments, authentication data and social-engineering indicators across multiple tools.

PHISH-TRACE AI was created to reduce the time between receiving a suspicious email and reaching an informed, evidence-based decision.

The goal is not to replace the analyst. The goal is to provide a secure, explainable and traceable workflow that converts a suspicious .eml file into actionable technical evidence while keeping the human operator in control.

What it does

PHISH-TRACE AI performs passive forensic analysis of suspicious email files without executing active content.

The platform:

  • Accepts .eml files as untrusted evidence.
  • Calculates the SHA-256 hash of the original message.
  • Extracts relevant email headers and metadata.
  • Identifies Reply-To, Return-Path and sender-domain inconsistencies.
  • Extracts URLs without visiting them.
  • Inspects attachment metadata without executing attachments.
  • Detects potentially dangerous attachment extensions.
  • Identifies social-engineering and credential-request indicators.
  • Preserves reported authentication information while distinguishing reported data from verified trust.
  • Generates an explainable deterministic risk score.
  • Classifies messages as LOW, SUSPICIOUS, HIGH or CRITICAL.
  • Allows the operator to explicitly create an incident.
  • Exports incident evidence as structured JSON.
  • Correlates analyzed emails using shared technical indicators.
  • Calculates contextual risk when campaign-level relationships are detected.
  • Generates an interactive Threat Graph.
  • Suggests relevant remediation actors while keeping all actions human-controlled.

Explainable risk assessment

PHISH-TRACE AI does not return only a final score.

The interface exposes the technical findings that contributed to the classification and their individual weights, allowing an analyst to understand why a message received a particular risk level.

For example, indicators can include:

  • Reply-To domain mismatch.
  • Return-Path domain mismatch.
  • URL domain mismatch.
  • Credential requests.
  • Potentially dangerous attachment extensions.
  • Other deterministic technical findings.

This approach makes the assessment reviewable and reproducible instead of relying on an opaque decision.

Campaign correlation

A suspicious email may appear differently when analyzed in isolation than when compared with other evidence.

PHISH-TRACE AI can correlate two analyzed messages using shared technical indicators such as:

  • Reply-To domains.
  • Return-Path domains.
  • URL domains.

When sufficient shared evidence exists, the platform can identify a technical relationship and calculate a contextual risk assessment.

The system deliberately separates correlation from attribution.

A relationship such as RELATED CAMPAIGN does not mean that PHISH-TRACE AI has identified the attacker. The interface explicitly maintains:

Attribution: NOT DETERMINED

This is an intentional security and evidentiary boundary.

Threat Graph

The interactive Threat Graph provides a visual representation of the technical evidence connecting analyzed emails.

It displays:

  • The baseline email.
  • The current email.
  • Shared technical indicators.
  • The relationships between them.

The graph is evidence-based and does not imply attacker identity or legal attribution.

Human-controlled remediation

PHISH-TRACE AI translates technical findings into operational guidance by identifying relevant response roles, including:

  • SOC / Security Operations.
  • Email / Identity Administrator.
  • Incident Response / Evidence Custodian.

Suggested actions such as ACKNOWLEDGE, REMEDIATE and PRESERVE remain recommendations.

The MVP does not automatically block accounts, delete messages, isolate systems or perform legal attribution. Final decisions remain under human control.

Security by design

The application follows a passive-analysis model.

During analysis:

  • Active HTML is not executed.
  • Attachments are not executed.
  • URLs are not automatically visited.
  • Remote content is not loaded.

Evidence retention is also explicit. Analysis alone does not automatically create a persistent incident record. The user must intentionally create an incident.

How we built it

PHISH-TRACE AI uses a separated frontend/backend architecture.

Backend

  • Python
  • FastAPI
  • Deterministic email-analysis engine
  • MIME parsing
  • SHA-256 evidence hashing
  • Risk scoring
  • Campaign correlation
  • Incident and evidence workflow

Frontend

  • Next.js
  • React
  • TypeScript
  • React Flow for interactive threat visualization

Infrastructure

  • GitHub for source control and development checkpoints
  • Railway for the production backend
  • Vercel for the production frontend

The project was developed incrementally using validated checkpoints so that each major capability could be tested before adding the next layer.

Challenges we faced

One of the main challenges was balancing useful automation with forensic caution.

A cybersecurity system can become dangerous if it automatically visits suspicious URLs, executes attachments or treats unverified information as fact. PHISH-TRACE AI therefore had to extract useful evidence without interacting with potentially malicious content.

Another challenge was distinguishing correlation from attribution. Shared infrastructure can support a campaign relationship, but it does not prove who is responsible. This distinction became an explicit design principle in the platform.

We also focused on making the risk engine understandable to both technical and non-technical users without hiding the reasoning behind a single score.

Accomplishments

During the hackathon we achieved a working production deployment that can:

  • Analyze suspicious .eml files end-to-end.
  • Preserve SHA-256 evidence integrity.
  • Produce explainable risk assessments.
  • Create explicit incident records.
  • Export structured evidence.
  • Correlate related suspicious emails.
  • Calculate contextual risk.
  • Visualize shared infrastructure through a Threat Graph.
  • Recommend operational response roles.
  • Run as a publicly accessible web application.

The complete production workflow was regression-tested using controlled email datasets before the final deployment checkpoint.

What we learned

The project reinforced that useful cybersecurity automation does not require removing the human from the decision loop.

Explainability, evidence preservation, trust boundaries and explicit limitations are as important as detection accuracy.

We also learned that isolated indicators become substantially more useful when they can be correlated and visualized as part of a broader technical context.

What's next

Future development could include:

  • Persistent case management with authenticated analyst accounts.
  • Multi-message campaign investigation.
  • Additional email-authentication verification.
  • IOC enrichment through controlled external intelligence sources.
  • Sandbox integrations for authorized attachment analysis.
  • Organization-specific scoring profiles.
  • Analyst collaboration and audit trails.
  • Additional visualization and reporting capabilities.

The long-term objective is to evolve PHISH-TRACE AI from a hackathon MVP into a secure investigation and decision-support layer for email-based cyber incidents.

AI Assistance Disclosure

OpenAI ChatGPT was used as an AI-assisted development tool for ideation, architecture review, debugging support, code review, documentation, testing guidance, and presentation preparation.

All implementation decisions, integration, testing, deployment, and final validation were performed by the participant.

PHISH-TRACE AI's runtime risk scoring and campaign correlation are deterministic and explainable. The current MVP does not rely on generative AI to make autonomous security decisions, perform attribution, or execute remediation actions.

Built With

Share this project:

Updates

Submission history