Email and calendar files
Upload an email file to open a case about the full message. livewells reads the file and reports what it finds. All links go to your case, ready to open in the disposable browser.
Send an email file
Send one of these files on the Upload a file tab, or through the API:
.eml, the standard email file that most mail programs export,.msg, the Outlook message file,.ics, a calendar invitation.
livewells detects the type from the content of the file, whatever the file name says.
What you see
- Message facts. Sender name, sender address, Reply-To, Return-Path, subject, date, message ID and the number of recipients.
- Received chain. One row for each server that passed the message on, oldest first, with its address and time.
- Sender checks. The SPF, DKIM and DMARC results that the receiving mail server wrote into the headers. The report shows the worst result for each check.
- Links. All web links from the plain text part and the HTML part, including form targets and image sources. Each link carries the place where it was found.
- Attachments. A table with name, declared type, size and SHA-256 for each attachment.
- Indicators. Addresses, domains, links, file names and hashes, ready for your own tools.
- Flags. Short statements in plain words, each with a level of high, medium, low or info.
livewells defangs all web addresses, host names, IP addresses and email addresses in a report. The link https://login.example.net/verify shows as hxxps[://]login[.]example[.]net/verify.
Open a link in the browser
Choose a link in the case to open it in the disposable browser. That link starts its own browser run, with its own recording and report. The step that removes the recipient from the link is optional.
Attachments become items
livewells sends each attachment to the reader for its file type. A forwarded message becomes an email item of its own. An HTML body becomes an HTML item, and an inline image becomes a QR item. Each item shows in the case below the message that held it. The nesting limit is three levels.
Limits
| Limit | Value |
|---|---|
| File size | 25 MiB |
| MIME parts in one message | 200 |
| MIME nesting depth | 10 |
| Header size | 256 KiB in total, 998 characters on one line |
| Links listed | 500, each at most 2,048 characters |
| Plain text and calendar values | The first 5 MiB of each is read |
| Links in one text | 2,000. The first link of each site is listed first. |
| Attachments listed | 200 |
| Attachments handed on | 100 |
| Inline images handed on | 20 |
| Calendar events | 1,000 |
When a message passes a limit, the case shows the flag limit-exceeded and lists what livewells did not open.
An attachment that livewells reads and lists only keeps its hash and shows the word "Listed only". An attachment that livewells cannot read, or that is past the data budget, shows "not read" in place of a hash. An attachment that cannot be read also raises unreadable-attachment.
Flags
| Flag | Level | What it tells you |
|---|---|---|
attachment-name-trick | high | An attachment name uses hidden characters. |
dangerous-attachment | high | An attachment is a file type that can start a program. |
dmarc-fail | high | The headers record that the domain policy check (DMARC) failed. |
double-extension | high | An attachment name ends in two file types to hide its real type. |
link-text-mismatch | high | A link shows one web address and goes to another. |
link-userinfo | high | A link puts a name before an @ sign to hide its real site. |
multiple-from | high | The message has more than one sender header. |
name-reversed-text | high | An attachment name uses characters that reverse the order of the text that follows. |
script-link | high | A link runs a script or holds inline data instead of opening a page. |
attachment-type-mismatch | medium | An attachment has a declared type that differs from its file name. |
display-name-spoof | medium | The sender name shows an address that differs from the real sender address. |
dkim-fail | medium | The headers record that the signature check (DKIM) failed. |
html-form | medium | The message holds a form that sends data to a site. |
limit-exceeded | medium | This message is larger or deeper than the checker reads. Some parts were not opened. |
link-ip-address | medium | A link goes to a number address, not a site name. |
link-punycode | medium | A link uses a site name written with look-alike characters. |
macro-attachment | medium | An attachment is a document type that can hold macros. |
name-trick-text | medium | The sender name or subject uses hidden or reversing characters. |
reply-to-differs | medium | Replies go to a different domain from the sender. |
spf-fail | medium | The headers record that the sender check (SPF) failed. |
unreadable-attachment | medium | An attachment could not be read. |
unreadable-message | medium | We could not read this file as an email message. |
archive-attachment | low | An attachment is an archive that can hide other files. |
dkim-domain-differs | low | The signature domain differs from the sender domain. |
link-shortener | low | A link uses a short-link service that hides its target. |
no-received | low | The message has no record of the servers that passed it on. |
no-sender | low | The message has no sender address. |
remote-content | low | The message loads content from other sites when it opens. |
return-path-differs | low | The bounce address uses a different domain from the sender. |
spf-softfail | low | The headers record a weak result for the sender check (SPF). |
auth-not-recorded | info | The headers hold no sender check results. |
forwarded-message | info | The message holds another message as an attachment. |
A flag gives context. Your analysts set the verdict.