Spamalyzer by Libor Benes (Dr. B)

🏛 About Spamalyzer:
Spamalyzer turns raw spam and phishing email headers into a structured, forensic-ready report in a dedicated Firefox sidebar. Paste the headers and instantly see authentication results, the hop-by-hop delivery path, a probable origin IP, and every IP, domain, link, address, and attachment worth investigating. Built for hackers, system admins, pentesters, and forensic analysts who need fast answers without uploading evidence anywhere.

📐 Desktop Sidebar Design:
✨ Neon Cyberpunk Aesthetic: Features high-contrast cyan titles, pink section badges, a green copy action, and amber and red severity colors set against a deep indigo backdrop (#10122b) for easy low-light scanning.
🎯 Verdict First: A color-coded suspicion score and severity-sorted findings sit at the top, followed by collapsible sections for detail.
📋 One-Click Export: Copy a clean indicator list or a full plain-text report, with a status line confirming the result.

⚙ How It Works — Nothing Sent Anywhere:
• All analysis runs locally inside the sidebar; your headers are never uploaded, logged, or stored.
• It does not read your tabs, cookies, or history, and it makes no network requests of its own.
• Every heading, value, and status message is built with safe, text-only DOM methods, and extracted links are displayed as plain text, never as clickable anchors.
• The only privileged action is writing text to your clipboard when you click a copy button. Optional lookup links open in a new tab only if you click them.

🔍 Analysis Coverage:
• Sender and headers: From, Reply-To, Return-Path, Subject (encoded words decoded), Date, Message-ID, mailer, MIME types, and X-Spam headers.
• Authentication: SPF, DKIM, and DMARC results, plus DKIM domain alignment checks.
• Routing: Received chain oldest first, with IPs, protocol, timestamps, per-hop delay, clock-skew detection, and a probable origin IP.
• Indicators: IP addresses, domains, links, email addresses, attachments, wallet addresses, and phone numbers, with optional VirusTotal, AbuseIPDB, and urlscan pivot links.
• Deception checks: display-name spoofing, mismatched sender domains, punycode, raw-IP links, URL shorteners, link text that hides its real target, double-extension attachments, hidden characters, tracking pixels, and HTML forms.

📊 What You See:
📇 Verdict Panel: Suspicion level, 0–100 heuristic score, and a SHA-256 of the pasted text for case notes.
🛡 Authentication Block: Pass results in green, warnings in amber, failures in red.
🛰 Received Chain: Numbered hops with timing, so the delivery path is easy to follow.
🧬 Indicator Lists: Tagged and flagged items, defanged by default for safe sharing.

🖥 Features:
🔬 Forensic-Ready Output — Findings, indicators, and a report you can paste straight into a ticket or case file.
🧪 Defang Toggle — Share hxxp, [.] and [@] forms safely with your team.
📋 Two Copy Actions — Copy Indicators (green) and Copy Report (amber).
🪶 Zero Network Footprint — Works offline in isolated labs.

🎯 Perfect for:
• Forensic Investigators & Incident Responders tracing delivery paths and documenting indicators of compromise.
• System Administrators & Mail Admins diagnosing SPF, DKIM, and DMARC results.
• Pentesters & Red/Blue Teams reviewing phishing campaigns and awareness tests.
• Threat Hunters & Abuse Desk Analysts extracting IPs, domains, and attachments to block, report, or pivot on.

🔒 Security-First Architecture:
✅ No Data Collection — Formally and explicitly declared natively within manifest.json.
✅ No Telemetry — No analytics tracking, no user profiling, and no third-party request pipelines.
✅ No eval() or innerHTML — Strictly text-only DOM mutation throughout the entire application layer.
✅ No Persistent Storage — Nothing is written to disk; nothing survives beyond the active session.
✅ No Host Permissions — The add-on requests no network or tab access.
✅ Permissions Matched to Function — Relies strictly on clipboardWrite for the copy buttons.

🛠 Technical Details:
• Compatibility: Firefox 140.0+ Desktop only.
• Runtime Execution RAM Footprint: ~51 KB (core scripts: manifest.json + sidebar.html + sidebar.css + sidebar.js).
• Total Extension Download/Install Size: ~113 KB (including README.md).
• Compressed Folder (.zip): ~38 KB.
• Background scripts: None.
• Network requests: None from the add-on itself.
• Storage: None. No browser storage APIs are used.
• Input limit: 500,000 characters.
• Data Collection: None (explicitly declared).

⚠ Limitations:
📚 Heuristic Triage — The score is a triage aid, not a verdict. Well-authenticated spam from a legitimate account can score low.
🔎 Headers Can Be Forged — Hops before your first trusted server may be fake, so verify the probable origin IP.
🌐 English Keywords — Language signals use English phrases; header checks work in any language.
🖥 Desktop Only — Firefox sidebars are not available on Android.

⚠ Legal Disclaimer:
Spamalyzer is an independent browser utility developed for informational and forensic workflow purposes. It is not affiliated with, endorsed by, sponsored by, or in any way officially connected to Mozilla Corporation, Google LLC, Microsoft Corporation, VirusTotal, AbuseIPDB, urlscan.io, or any other organization or service mentioned in the application. Results are heuristic and should be verified before action is taken.