Email analysis and security

Understand email.
Expose the threats.

SpamScope was created to analyze email: a channel used for phishing, fraud, credential theft, and malware delivery, often through social engineering.

Discover mail-parser

SPAMSCOPE / MAIL-PARSER SpamScope logo

EMAIL / STRUCTURE / EVIDENCE

From the platform to a library open to everyone.

The project

Born in SpamScope.
Built as a library for everyone.

From the start, the decision was to extract mail-parser from the SpamScope platform and develop it as an independent library. Anyone can integrate it into their own tools to examine email messages, reconstruct their structure, and preserve evidence useful in forensic analysis.

Complete components

Headers, plain text and HTML bodies, attachments, and metadata in a structured object.

Details worth preserving

Extract headers, bodies, attachments, and Received hops. Distinguish the display name from the mailbox in From while preserving the original value.

Anomalies to examine

Detect address and MIME structure defects that may hide content or evasion techniques without discarding the raw evidence.

Ready to integrate

Access Python properties, raw values, and JSON in security and digital forensics workflows.

.eml

Standard email

Analyze raw email messages and their MIME parts.

.msg

Microsoft Outlook messages

Convert Outlook files to .eml through an optional backend, then analyze their content.

From raw to structured

An email becomes
a JSON object.

The animation uses a test message from the repository. The excerpt shows how an address-like display name can differ from the mailbox in From. It does not authenticate the sender’s identity.