Doplňky
Vítejte na serveru Doplňky pro Thunderbird.
Přidejte si funkce a styly, které učiní Thunderbird podle vašich představ.
Zavřít
mleak - mail metadata osint 0.5.9
od Marco Lux
mleak is a Thunderbird extension for per-mail osint header and body analysis. MUA fingerprints, server stack, M365 tenant data,relay path, auth verdicts and integrity signals.
100 % offline. No network access, no telemetry, no external dependencies.
O doplňku
WebExtension for Thunderbird 115+. Analyses headers and body on a per-message basis and shows structured OSINT intel — either as a popup or directly inline above the mail body.
- MUA / client: from User-Agent, Message-ID patterns, HTML-body signatures, MIME-Version parenthetical, and MIME-boundary prefixes (Apple-Mail / enig / 000 / NextPart) — five independent signals, cross-validated
- Server stack: Gmail · Exchange/M365 · Apple iCloud · Yahoo · delivery markers (Proofpoint / Mimecast / Barracuda)
- M365 tenant GUID + datacenter region: direct org attribution without whois
- Relay path: hop count, external relays, internal hostname leaks (incl. single-label NetBIOS / k8s pod names), private IPs from Received (IPv4 + IPv6 ULA / link-local), per-hop context ("10.x.x.x at relay.example.com from ws-eve.corp.local")
- Authentication: SPF / DKIM / DMARC / ARC / BIMI verdicts + DKIM signatures (domain, selector, vendor hint)
- Crypto: Enigmail version (via X-Enigmail-Version or the enig… boundary prefix), OpenPGP/MIME, S/MIME, Autocrypt / Autocrypt-Gossip, OpenPGP keyserver hint, Symantec PGP-Universal, Tutanota, ProtonMail
- Integrity: missing Date/MID, From↔Sender divergence, Reply-To cross-domain, DKIM h=-coverage gaps, oversigning
- Timezone: UTC normalisation + TZ offset
- MIME structure: compact tree fingerprint
- MUA / client: from User-Agent, Message-ID patterns, HTML-body signatures, MIME-Version parenthetical, and MIME-boundary prefixes (Apple-Mail / enig / 000 / NextPart) — five independent signals, cross-validated
- Server stack: Gmail · Exchange/M365 · Apple iCloud · Yahoo · delivery markers (Proofpoint / Mimecast / Barracuda)
- M365 tenant GUID + datacenter region: direct org attribution without whois
- Relay path: hop count, external relays, internal hostname leaks (incl. single-label NetBIOS / k8s pod names), private IPs from Received (IPv4 + IPv6 ULA / link-local), per-hop context ("10.x.x.x at relay.example.com from ws-eve.corp.local")
- Authentication: SPF / DKIM / DMARC / ARC / BIMI verdicts + DKIM signatures (domain, selector, vendor hint)
- Crypto: Enigmail version (via X-Enigmail-Version or the enig… boundary prefix), OpenPGP/MIME, S/MIME, Autocrypt / Autocrypt-Gossip, OpenPGP keyserver hint, Symantec PGP-Universal, Tutanota, ProtonMail
- Integrity: missing Date/MID, From↔Sender divergence, Reply-To cross-domain, DKIM h=-coverage gaps, oversigning
- Timezone: UTC normalisation + TZ offset
- MIME structure: compact tree fingerprint
