SIH26106: AI-Powered Email Threat Detection, GeoLocation and Forensic Intelligence Platfor — SIH 2026 | Wynit

SIH26106: AI-Powered Email Threat Detection, GeoLocation and Forensic Intelligence Platfor — SIH 2026 | Wynit

What they'll ask you

12

Generated from the brief's own wording and the competition's published rules, never from a guess about what this ministry prefers.

Specific legal and evidentiary standard requirements for chain of custody?
The brief never answers this, so a panel will. Whatever you decide, say it the same way twice.
Integration formats required for existing institutional email servers?
The brief never answers this, so a panel will. Whatever you decide, say it the same way twice.
Has any part of this been shown at a previous event, hackathon or college project?
The guidelines are explicit: your solution must not have appeared in any previous event or programme, of any sort. A recycled project is what a team under time pressure reaches for.

9 morethe ones a panel gets to if there is time

The brief asks for fraudulent email detection engine. How would you build that?
Decoded from SIH26106 itself: An NLP and ML module that scans email text and links to classify phishing, spoofing, and business email compromise risks. The brief asks for it by name.
The brief asks for email header analyzer. How would you build that?
Decoded from SIH26106 itself: A module that parses headers like SPF, DKIM, DMARC, and Return-Path to spot anomalies and forged sender fields. The brief asks for it by name.
The brief asks for origin traceability module. How would you build that?
Decoded from SIH26106 itself: A component that extracts originating IP addresses from relay chains and maps their geolocation and hosting infrastructure. The brief asks for it by name.
The brief asks for identity correlation module. How would you build that?
Decoded from SIH26106 itself: A graph-based tool that links email indicators to known threat data and groups related fraud campaigns. The brief asks for it by name.
The brief asks for analyst dashboard and reporting. How would you build that?
Decoded from SIH26106 itself: A dashboard providing real-time alerts, visual trace maps, and structured forensic reports for investigations. The brief asks for it by name.
Where does your data come from: a published source, one you collect, or one you generate?
No dataset is attached to this problem statement, so sourcing it is part of the work and nobody told you that.
Why not use what already exists? Name the closest thing to this that is already running.
A team that has not named the alternative themselves is answering this for the first time in the room.
Which single thing will you demonstrate end to end, start to finish, with nothing skipped?
Ours, not a rule: a narrow thing that fully works survives questioning better than a broad thing that half works. If nobody on the team can name it, that is the finding.
Show me this working: the jury will check if the platform can successfully parse raw email headers, accurately trace relay paths back to an IP address, map geolocation, and generate coherent forensic reports.
This is the evaluator read for your problem statement, decoded from the brief's own wording.

The government's original description (907 words)

• Background Email continues to be one of the most widely used communication channels in government, education, banking,and enterprise ecosystems. However, it also remains one of the most exploited attack vectors for phishing,impersonation, business email compromise, financial fraud, credential theft, and malware delivery. Threat actors increasingly use spoofed domains, deceptive sender identities, social engineering techniques, and compromised infrastructure to send highly convincing fraudulent emails that appear legitimate to end users.Traditional email security controls such as spam filters, static blacklists, and rule-based signature mechanisms are often insufficient to detect sophisticated fraudulent emails. Attackers now use AI-generated language,domain lookalikes, display-name spoofing, hidden redirection links, and relay chains to evade standard detection systems. In many cases, even when a suspicious email is identified, organizations lack the technical capability to effectively trace the source path, identify probable sender infrastructure, correlate geolocation clues, and support investigation into the origin of the email.This gap creates major challenges for cybersecurity teams, law enforcement support, fraud response units, and institutional administrators who need not only to detect malicious emails but also to investigate their source and reveal indicators that may help identify the actor or infrastructure behind the attack. • Problem Statement Current email security ecosystems primarily focus on filtering or blocking suspicious content but provide limited intelligence for deep forensic tracing of fraudulent email origins. Existing tools often do not adequately correlate email headers, SMTP relay paths, SPF/DKIM/DMARC validation results, IP reputation, geolocation indicators, domain registration intelligence, and behavioral patterns to build a complete picture of the senderâ€™s identity or operating location.There is a need for an AI-powered platform capable of detecting phishing, spoofed, impersonated, and fraudulent emails in real time or near real time, analyzing the complete technical structure of an email, tracing its transmission path across mail servers, estimating its origin with location, and generating forensic intelligence and investigative insights that assist in identifying malicious infrastructure, compromised systems, or threat actors behind the attack.The solution should support forensic analysis, fraud prevention, institutional email security, and investigation workflows while maintaining legal, privacy, and evidentiary standards. • Proposed Solution Develop an AI-Powered Email Threat Detection, GeoLocation and Forensic Intelligence Platform that combines Natural Language Processing (NLP), Machine Learning (ML), email header forensics, IP intelligence, domain analysis, and graph-based correlation to identify suspicious emails,detect advanced email threats, and investigate their probable origin. The system should ingest raw email content, metadata, and headers; validate sender authentication mechanisms; extract indicators of compromise; reconstruct relay paths; analyze originating IP addresses and associated geolocation data; and generate a confidence-based assessment of fraud risk and probable sender origin. The platform should provide actionable alerts, visual trace maps, and forensic reports for security analysts,administrators, and investigators. • Key Components • Fraudulent Email Detection Engine o NLP-based analysis of email subject lines, body text, urgency cues, impersonation language, and social engineering patterns. o Detection of phishing indicators such as spoofed sender addresses, deceptive domains, suspicious attachments, malicious links, and obfuscated URLs. o AI/ML models to classify emails as legitimate, suspicious, impersonated, phishing, or fraud-related. o Identification of business email compromise patterns such as payment diversion, fake invoice requests, credential harvesting attempts, and executive impersonation. • Email Header and Protocol Analysis Module o Deep analysis of email headers including Return-Path, Received headers, Message-ID, Reply-To,DKIM signatures, SPF alignment, and DMARC status. o Detection of anomalies in mail routing, forged sender fields, relay manipulation, and spoofed transmission records. o Validation of whether the email was sent through authorized infrastructure or suspicious relay paths. • Origin Traceability and Location Analysis o Extraction of originating IP addresses from header chains and identification of the earliest reliable sending node. o IP geolocation mapping to estimate the likely country, region, city, ISP, hosting provider, or proxy service associated with the email source. o Correlation with VPN, TOR, open relay, botnet, or cloud-hosted infrastructure indicators where applicable. o Domain intelligence analysis using WHOIS data, DNS records, MX records, hosting fingerprints,and registrar details to identify suspicious sender infrastructure. • Identity Correlation and Attribution Support o Correlation of email indicators with known threat intelligence, blacklists, previous incidents,domain clusters, and repeated fraud campaigns. o Graph-based relationship analysis between sender domains, IP addresses, aliases, reply chains, and linked infrastructure. o Confidence-based investigative assessment to assist in revealing probable sender identity, associated infrastructure, or campaign-level attribution patterns. o Support for flagging whether the email likely originated from a compromised account, spoofed domain, anonymized infrastructure, or direct malicious actor environment. • Alerting, Dashboard, and Forensic Reporting o Real-time alerts for high-risk emails before user interaction or administrative approval. o Analyst dashboard showing fraud score, spoofing indicators, sender trace path, geolocation map,and attribution confidence. o Generation of structured forensic reports for institutional action, legal review, cyber incident response, and support to law enforcement agencies. o Searchable case management view for grouping related fraudulent emails into campaigns. • Privacy, Legal, and Compliance Safeguards o Controlled handling of personal data and metadata in accordance with organizational privacy policies. o Logging, evidence preservation, and chain-of-custody support for investigation purposes. oConfigurable retention and masking mechanisms for sensitive communication data. • Expected Outcomes • Early and accurate detection of fraudulent, spoofed, and phishing-based email attacks. • Improved ability to trace suspicious email origin paths and identify probable source infrastructure. • Enhanced fraud investigation capability through geolocation analysis, domain intelligence, and sender attribution support. • Reduced financial loss, reputational damage, and unauthorized disclosure of confidential information caused by email-based fraud. • Better institutional readiness for cyber incident response, forensic investigation, and enforcement coordination.