Running AI Forensic Threat Triage & Multi-Hop Hop Tracer...
Tap or Drop .EML / .MSG Evidence
Parses transport headers, extracts multi-hop SMTP routing, resolves originating GeoIP/ASN, and computes deterministic threat matrix.
RAW INTAKE
Paste RFC 5322 Headers & Message Body
HEADER & TEXT THREAT ASSESSMENT
Clean Header Assessment
0/100
CLEAN / SAFE
From (Claimed Identity)
--
To (Recipient)
--
Subject
--
Extracted Origin IP
Direct / None
SPF
PASS / NONE
DKIM
NEUTRAL
DMARC
BEST EFFORT
Domain Match
ALIGNED
Evaluated Threat Signals & Ledger
Upload Suspicious File for Disassembly
Calculates Shannon entropy, verifies true Magic-Byte signatures vs fake extensions, and checks SHA-256 threat hashes.
FILE STATIC BYTE DISASSEMBLY
sample.pdf
0/100
SAFE / BENIGN
Detected Format
PDF Document
File Size
45.2 KB
True Magic Bytes (Hex)
25 50 44 46 2D 31 2E 37
Shannon Entropy
7.45 (Normal PDF)
SHA-256 Cryptographic Hash
--
Disassembly Findings & Payload Verification
✓ No malicious executable payload or macro trigger detected.
AIR-GAPPED EMBEDDED WEB RUNTIME
🌐 Chromium Sandbox Browser & Web Detonator
Fast Targets:
VERDICT:
🟢 SAFE IN-APP BROWSING
RISK:
20/100
104.21.48.204
🎣 AIR-GAP CREDENTIAL INTERCEPTED
TRAPPED SAFELY
Account: user@example.com | Password: •••••••• (Isolated in Memory)
Google
● Sandboxed Chromium Subsystem · 100% In-App
Isolated Memory Guard · Zero DNS Leaks
📡 Live Outbound Network Telemetry & DNS Interception Stream
ACTIVE INTERCEPTION
▼
| PROTOCOL / METHOD | DESTINATION TARGET | REMOTE IP:PORT | HTTP STATUS | SECURITY VERDICT |
|---|---|---|---|---|
| DNS_QUERY | accounts.google.com.inbound.local | 127.0.0.53:53 | RESOLVED (A) | 🛡️ PINNED_DNS |
| TLS_v1.3 | https://accounts.google.com/signin/v2/identifier | 142.250.190.46:443 | HANDSHAKE_OK | 🔒 CIPHER_AES_GCM |
| HTTP GET | /ServiceLogin?service=mail&continue=https%3A%2F%2Fmail.google.com | 142.250.190.46:443 | 200 OK (38.2 KB) | ✓ CLEAN_DOM |
INVESTIGATIVE FORENSIC DOSSIER
SUSPICIOUS PHISHING / BEC ATTACK
85/100
HIGH RISK
SIH #26106 COMPLIANT · SEC 65B IEA & SEC 63 BSA CERTIFIED
CATEGORY
Phishing / BEC
Sender Identity
Target Mailbox
Origin Location
Preservation SHA-256
TAMPER-PROOF LEGAL EVIDENCE (SEC 65B)
🔒 Legal Evidence Vault (डिजिटल सबूत लॉक)
Consortium Network
Forensic Ledger PoA Notary
सरकारी फॉरेंसिक नोड्स द्वारा अधिकृत नेटवर्क (PoA)
Evidence Custody Status
Local Pre-Anchor
क्रिप्टोग्राफिक साक्ष्य स्थिति (Merkle Notary)
Digital Receipt Seal (Transaction Hash)
0xdbbb1c...4669
कोर्ट में प्रस्तुत करने योग्य अपरिवर्तनीय डिजिटल रसीद
Master Integrity Proof (Merkle Root)
0xMerkleRoot...
0% छेड़छाड़ गारंटी का गणितीय प्रमाण (हैश रूट)
Smart Contract (ऑटो-कस्टडी)
EvidenceNotary.sol
Sec-65B स्वचालित कस्टडी सत्यापन अनुबंध
Sealed & Court Admissible (अपरिवर्तनीय साक्ष्य)
ATTACK INVESTIGATION & SECURE STORAGE
🌿 Attack Link Graph & ⚡ Secure Case Vault
Attack Relationship Engine (Neo4j)
ACTIVE GRAPH (सक्रिय लिंक)
हमलावर, आईपी और ईमेल के बीच कनेक्शन की लाइव मैपिंग
Attack Entities & Links (नोड्स व किनारे)
5 Entities · 4 Links (5 नोड्स · 4 लिंक)
प्रेषक, स्रोत आईपी, इनबॉक्स, अभियान एवं साक्ष्य
Encrypted Case Storage (Supabase)
SECURE STORAGE ACTIVE (सुरक्षित एक्टिव)
सरकारी मानकों के अनुरूप एन्क्रिप्टेड केस स्टोरेज
Target Database Table (केस फ़ाइल टेबल)
public.forensic_cases
कोर्ट रिपोर्ट हेतु डिजिटल केस फाइल फ़ोल्डर
GLOBAL VENDOR REPUTATION
🌐 Domain Blacklist & Threat Intel
Sender Domain Checked
mail.gmail.com
Global Threat Consensus
14 / 72 Security Engines Flagged
Spamhaus SBL / CSS Status
LISTED (Blacklisted Origin)
Google Safe Browsing
Phishing & Deceptive Site Alert
SCORE LEDGER
Observed Threat Signals
COMPONENT 2 & 3 · REAL-TIME FORENSIC AIR CORRIDOR TRACE
SMTP Multi-Hop Relay Path & GeoIP Flight Trajectory
HOP #1 ORIGIN MTA
SRC
🚨
Resolving Sender...
--
--
COORDS:
--
SRC
───────✈───────▶
DST
-- KM
FLIGHT DISTANCE
-- HOPS
RELAY NODES
--°
GREAT CIRCLE BEARING
--s
TRANSIT DELTA
● RADAR SWEEP ACTIVE · GEODESIC TRAJECTORY LOCKED
INBOUND MX GATEWAY
MX-IN
🛡️
Target Inbound Node
--
--
SECURITY:
TLS 1.3 ChaCha20
Sender Origin
Transit Relay
Inbound MX Gateway
Great Circle Corridors
LAT: 28.6139°N | LON: 77.2090°E
MTA Forensic Chain of Custody & Reverse-DNS Telecom Ledger
-- Hops Reconstructed
COMPONENT 4 · DEEP THREAT IDENTITY CORRELATION & CAMPAIGN ATTRIBUTION GRAPH
Neo4j Graph Database Topology & STIX 2.1 Campaign Cluster Engine
Topology Filter:
Campaign Cluster
--
Attribution Confidence
--
Graph Entities
-- Nodes · -- Edges
Classification
--
Neo4j Ledger Status
CYPHER READY
SIH 2026 #26106 · NEO4J THREAT TOPOLOGY · CLICK NODE TO INSPECT
Origin MTA
Transit Relay
Sender Identity
Target Recipient
Campaign Cluster
Evidence Digest
Payload URL
Attachment File
SELECT ANY ENTITY TO VIEW FORENSIC INTELLIGENCE
Selected Graph Entity Deep Dive
CAMPAIGN CLUSTER
☣️
Threat Campaign Cluster
Autonomous Clustering Matrix
Full Entity Value--
Threat Context--
Neo4j Cypher Label(:ThreatCampaign)
Graph Pivot Analysis & Threat Indicators
IOC CORRELATED
Analyzing correlation graph linkages between sender domains, transport IP relays, cryptographic signatures, and payload hashes.
🕸️ Neo4j Schema Ingested
🔗 STIX 2.1 Observable
🛡️ Section 65B Anchored
DEEP NLP & PSYCHOLOGICAL THREAT EXTRACTION (1,000,000+ WORD CAPACITY)
Paragraph-by-Paragraph Semantic Threat Dissection
Scanned Paras
0
Flagged Paras
0
NLP Score
0/100
TACTICS & TECHNIQUES
MITRE ATT&CK Enterprise Matrix Mapping
T1566.001 Attachment
T1566.002 Link
T1586.002 Compromised
T1078 Valid Accounts
🤖 AI Forensic Breakdown (Bilingual / द्विभाषी):
🤖 SentinelMail AI Forensic Copilot (एआई से सवाल पूछें)
Interactive Investigation Assistant · Context-Aware Triage Grounding
AI
Namaste Investigator! Main aapka SentinelMail AI Forensic Copilot hu. Is email ke headers, spoofing status, origin IP (Czech Republic), attachments ya Section 65B legal court evidence ke baare me aap mujhse kuch bhi pooch sakte hain. Upar diye suggestion buttons par click karein ya apna sawal niche type karein!
COMPONENT 2
RFC Header Protocol Authentication Matrix
SPF (Sender Policy Framework)
Verifies if sending server IP is authorized in DNS SPF TXT record (प्रेषक आईपी प्राधिकरण जांच)
DKIM (DomainKeys Identified Mail)
Cryptographic RSA signature proving email body & headers were not tampered in transit (डिजिटल हस्ताक्षर सुरक्षा)
DMARC (Domain-based Policy)
Enforces organizational policy against unauthorized spoofing (डोमेन अलाइनमेंट एवं सुरक्षा नीति)
🔍 What "BEST EFFORT" Actually Evaluated (बेस्ट एफर्ट में क्या जांचा गया):
1. Public DNS Policy Check: Sender domain lacked a published strict enforcement policy (
2. SPF Pass Fallback: Checked connecting MTA against envelope authorization to prevent false rejections.
3. Return-Path Alignment: Verified that envelope bounce domain matches the visible
4. Cryptographic DKIM Header: Inspected message headers for DKIM selector integrity.
p=reject / p=quarantine) in public DNS records.2. SPF Pass Fallback: Checked connecting MTA against envelope authorization to prevent false rejections.
3. Return-Path Alignment: Verified that envelope bounce domain matches the visible
From: domain.4. Cryptographic DKIM Header: Inspected message headers for DKIM selector integrity.
👉 सार (Hindi): जब किसी डोमेन के डीएनएस में सख्त 'p=reject' पॉलिसी नहीं होती, तब सिस्टम झूठे अलर्ट से बचने के लिए एसपीएफ, रिटर्न-पाथ और डीकिम के आंतरिक मिलान द्वारा बेस्ट-एफर्ट सत्यापन करता है।
Return-Path vs From: Alignment
RFC 5321 envelope bounce address matches header From: identity (हेडर और लिफाफा प्रेषक का मिलान)
Message-ID RFC 5322 Format
Unique globally qualified message identifier syntax & domain entropy (मानक आरएफसी 5322 आईडी प्रारूप)
GLOBAL THREAT REPUTATION MATRIX
🌐 Multi-Vendor Domain & IP Blacklist Verification
Evaluated Sender Domain
mail.gmail.com
Origin IP Address
101.99.94.155
Autonomous System (ASN)
AS28753 (LeaseWeb Europe)
Spamhaus Zen Status
LISTED (SBL / CSS)
🔍 Live Multi-Vendor Blacklist Query (किसी भी डोमेन/आईपी की तुरंत जांच करें):
Security Company & Threat Engine Verdicts
URL EXTRACTION
Payload & Redirection Links
ATTACHMENTS
Disassembled Attachment Forensics
⚖️ DUAL STATUTORY COMPLIANCE: SEC 65B IEA & SEC 63 BSA (2023)
GOVERNMENT OF INDIA · CENTRAL DIGITAL FORENSIC EXAMINATION DIVISION
EXPERT CERTIFICATE OF ELECTRONIC EVIDENCE
Statutory Certificate Under Section 65B(4) Indian Evidence Act, 1872 & Section 63 Bharatiya Sakshya Adhiniyam, 2023
Preserved in Accordance with ISO/IEC 27037:2012 Digital Evidence Handling Guidelines
LEGAL EVIDENCE // COURT ADMISSIBLE
REF NO: SIH2026-EVID-26106
1. Chain of Custody & Cryptographic Identification
| Evidence Custody ID | Acquisition Time (UTC) | ||
|---|---|---|---|
| Cryptographic SHA-256 | |||
| Subject Line | Integrity Status | Cryptographically Sealed & Tamper-Proof | |
2. Decentralized Blockchain Notary & Merkle Proof
| Consortium Blockchain | Consortium Ledger (PoA Prototype / ISO 27037) | Block Height | |
|---|---|---|---|
| On-Chain Tx Hash | |||
| Merkle Root Anchor | Consensus Status | CONFIRMED & IMMUTABLE (Byzantine Fault Tolerant) | |
3. Sender Identity & Geolocation Attribution Analysis
| Claimed Sender (From) | Target Mailbox (To) | ||
|---|---|---|---|
| Originating MTA Node | Origin IP & ASN | ||
| Physical Geolocation | Campaign Cluster ID |
4. RFC Transport Protocol Authentication Results
| SPF Authentication | DKIM Cryptographic Key | ||
|---|---|---|---|
| DMARC Enforcement | Relay Domain Alignment |
5. Technical Evidence Findings & Score Ledger Breakdown
PRIMARY CLASSIFICATION:
CALCULATED THREAT SCORE: /100
6. Certificate Declaration Under Section 65B Indian Evidence Act
I, the undersigned Certified Forensic Examiner, do hereby state and certify under Section 65B(4) of the Indian Evidence Act, 1872:
- The digital electronic record described herein was ingested, parsed, and evaluated by automated deterministic forensic routines during lawful investigation operations.
- The cryptographic hash (SHA-256) recorded above verifies that the digital record has remained intact, authentic, and un-tampered since acquisition.
- The technical findings, relay reconstructions, and threat classifications accurately reflect the immutable RFC transport headers and data elements of the analyzed evidence.
Preservation Engine: SUDO SPANDR SentinelMail (SIH #26106)
Evidentiary Status: Cryptographically Sealed & Immutable
Forensic Examiner / Cyber Crime Officer
Signature: ___________________________
Date & Station Seal: ______________________
AUTOMATED SOC INCIDENT RESPONSE
Perimeter Firewall & Threat Containment Rules
Origin Threat IP
--
Attacker Domain / MTA
--
Relay Hops Identified
--
Containment Status
READY FOR DEPLOYMENT
SYNTAX: BASH / NETFILTER
Deterministic containment based on observed RFC transport indicators
🛡️ Compatible with Palo Alto, Check Point, pfSense, Cisco, and AWS Security Groups.
SIH #26106 SOAR Specification
THREAT INTELLIGENCE CORRELATION ENGINE
APT28 / Fancy Bear Threat Profile
Threat Actor Aliases
--
Nation State / Tier
--
Attribution Confidence
96.4% HIGH
Targeted Industry Sectors & Demographics
Associated MITRE ATT&CK Tactics & Techniques
Weaponized Tooling & Malware Strains
Recommended National SOC Actions
COMPREHENSIVE FORENSIC AUDIT
Observed Threat Signals & Heuristic Score Ledger
Aggregate Threat Score
--
Primary Classification
--
Signals Correlated
--
Legal Compliance
Sec 65B Certified
PRESS ESC TO CLOSE
Calculating mathematical score breakdown...