A quick first release of an useful script for the identification of spam emails campaigns
The classification is based on 4 cases:
- email.src has more than 1 value (len(email.src) > 1)
- email[0] != all(email.src)
- every value in email[1:] is not in email.dst
- len(email.dst) != (len(email)-1)
The easiest way is to download all the meta as json. At the moment the input file name is hardcoded, put the file in the same folder and change the name of the file at line 14.
The script returns a csv file