TraceMail AI — Email Threat Detection & Forensic Intelligence

About the Project

🚨 The Problem

Phishing, business email compromise (BEC), sender impersonation, and malicious links remain serious cybersecurity threats. Investigating a suspicious email often requires analysts to examine email headers, verify authentication records, investigate URLs and IP addresses, correlate threat intelligence, and preserve evidence manually. This process can be slow and fragmented.

💡 Our Solution

TraceMail AI is an AI-assisted email threat detection and digital forensic intelligence platform that transforms suspicious emails into structured investigations.

Users can upload raw .eml email files or connect an authorized Gmail account to analyze messages through a unified forensic workflow.

⚙️ How It Works

TraceMail AI combines multiple analysis layers:

• Email Forensics: Parses email headers, sender identities, Reply-To addresses, return paths, MIME content, and relay information.
• Email Authentication: Analyzes available SPF, DKIM, and DMARC authentication results.
• Threat Intelligence: Integrates external security services to investigate IP addresses, domains, URLs, and other indicators of compromise.
• AI-Assisted Analysis: Examines suspicious language, urgency, impersonation patterns, and possible business email compromise indicators.
• Geolocation and Investigation: Presents available IP geolocation information alongside investigation timelines and attack-relationship visualizations.
• Evidence Preservation: Calculates SHA-256 hashes and generates forensic reports in supported formats, including PDF and JSON.

🧠 What Makes TraceMail AI Useful?

Instead of presenting only a phishing label, TraceMail AI brings email authentication, extracted indicators, threat-intelligence findings, behavioral analysis, and forensic evidence into one investigation workflow. This helps analysts understand why a message is suspicious and which findings support the assessment.

Geolocation indicates the location associated with an observed IP address; it does not independently prove an attacker's physical location or identity.

🛠️ Technology Stack

• Frontend: Next.js, React
• Backend: Python, FastAPI
• Database: PostgreSQL
• Security: JWT authentication, role-based access control, SHA-256 evidence hashing
• Intelligence: External threat-intelligence APIs
• AI: Behavioral analysis and AI-assisted explanations

🚀 What We Learned

Building TraceMail AI required integrating email parsing, authentication analysis, external intelligence providers, backend APIs, evidence handling, and a user-facing investigation dashboard. One of our key engineering challenges was bringing findings from different analysis components together into a consistent, understandable investigation.

🔭 Future Scope

Potential improvements include automated background inbox monitoring, richer threat-intelligence correlation, standardized STIX/TAXII exchange, stronger account security, and expanded enterprise incident-response workflows.

TraceMail AI — From suspicious emails to actionable forensic intelligence.

Built With

• ai
• cybersecurity
• digital-forensics
• email-security
• fastapi
• jwt
• next.js
• oauth-2.0
• postgresql
• python
• react
• rest-api
• sha-256
• threat-intelligence