Email Impersonation Detection Tool
An OSINT-driven engine that finds the lookalike mailboxes an attacker would use to impersonate a target, before they are used.
The problem
Impersonation attacks start quietly. Before a lure ever lands, an attacker registers a lookalike address, a swapped letter, an added word, a different domain, and that infrastructure sits invisible until the first phishing email arrives. By then it is a response problem, not a detection one.
What I built
An OSINT-driven engine that hunts that infrastructure proactively. From a target's name it generates hundreds of address variants through systematic name-mangling, then validates each one to find which are real, live mailboxes rather than theoretical typos.
- Validation runs through DNS/MX resolution and SMTP probing, so the output is confirmed-live infrastructure, not a wordlist.
- A multi-client backend adds VIP management, persistent investigation history, and MX-record caching for speed at scale.
- Real-time WebSocket progress streaming and automated alerting with Excel export let a threat-intel team map exposure as it is discovered.
The idea behind it
It moves impersonation from something you notice after the lure to something you map before it. Finding the attacker's staging ground early is cheaper than cleaning up the campaign later.