Email Ingestion & Forensic Triage
Paste full RFC 5322 email text, MIME source, or Received headers below:
Drag & Drop Email File (.eml, .msg, .txt)
Directly inspect raw email export files from Gmail, Outlook, Thunderbird, or Apple Mail
0 characters
|
Origin GeoResolution: ENABLED
|
Authentication Check: SPF / DKIM / DMARC
EXECUTING FORENSIC DECOMPILATION...
Tracing mail server transit hops and querying threat intelligence...
CRITICAL THREAT
ID: #AF-9281
Confirmed Malicious / Fake Phishing Email
Header forgery detected with deceptive link routing and high-risk origin server.
DETECTED SENDER LOCATION • PHYSICAL ORIGIN
Resolving location...
Origin Host: 194.26.29.10 • ISP: Carrier
Threat Risk Score
100
/ 100
CRITICAL RISK
Identity Spoofing35 pts
Auth Failure (SPF/DKIM)25 pts
Psychological Urgency20 pts
Malicious Link Threat25 pts
Origin Geo Anomaly20 pts
Identity & Envelope Alignment
Claimed Display Name:
PayPal Security Center
Visible From Address:
service@paypal-account-support.xyz
Envelope Return-Path:
bounce@bulletproof-relay.ru
Reply-To Address:
collector99@bulletproof-relay.ru
Recipient (To):
victim@company.com
Subject Line:
URGENT: Your PayPal Account Has Been Suspended
Client Mailer / UA:
DarkMailer v4.2 Pro
Message-ID:
9283748293.20260912@...
Return-Path mismatch and Display Name spoofing detected!
Cryptographic Authentication Matrix
SPF (Sender Policy)
FAIL
Sending IP not authorized by publisher SPF record.
DNS TXT: v=spf1 include:_spf.paypal.com ~all
DKIM (Digital Signature)
INVALID
Cryptographic signature missing or failed validation.
Signer: d=paypal-account-support.xyz (Misaligned)
DMARC (Policy Compliance)
REJECT
Failed alignment checks. Domain enforces reject policy.
Policy: v=DMARC1; p=reject; pct=100
Global Hop-by-Hop Transmission Route & Origin Pinpoint
Exact geographic routing of mail servers reconstructed from Received headers Origin (Hop 1)
Transit MTA
Recipient Server
TRUE SENDER HOST
194.26.29.10
Earliest Public Relay (Hop #1)
Location
Moscow, Russia 🇷🇺
Coordinates
55.7558° N, 37.6173° E
ISP / Carrier
Selectel Cloud / Bulletproof VPS
ASN / Organization
AS49505 (FastFlux Cyber)
Timezone
Europe/Moscow (UTC+3)
Reputation Status
FLAGGED ROGUE HOST
HOP-BY-HOP TRANSIT PATH (3 HOPS)
Forensic Anomaly & Threat Audit Log
| Severity | Threat Vector | Forensic Evidence & Explanation |
|---|
Embedded Link & Payload Inspector
Extracted Hyperlinks (1)
| Status | Visible Text (Anchor) | Actual Target URL |
|---|
Email Attachments & Payloads (0)
| Payload Filename | Format / Size | SHA-256 Hash | Risk |
|---|
AI SOC Senior Analyst Intelligence & Playbook
ENGINE: AETHERIS HEURISTIC SOC MATRIXEXECUTIVE THREAT SUMMARY
Loading intelligence assessment...
ATTACKER INFRASTRUCTURE VERDICT
Host 194.26.29.10 (Selectel Cloud / Bulletproof VPS, Moscow, Russia)
MITRE ATT&CK® TECHNIQUES MAPPED
INCIDENT RESPONSE REMEDIATION PLAYBOOK
Phone Number Intelligence & Location Tracker
Auto-extracted from email body • Country • Region • Carrier • Line Type • RiskRun a forensic scan — phone numbers found in the email body will auto-appear here with full location intelligence.