Email MIME structure: how it works and how it reveals fraud

The MIME structure defines how the content of an email is organized internally. It allows a message to include multiple parts, such as plain text, HTML, embedded images, or attachments. Understanding this structure is essential for analyzing suspicious emails and detecting manipulations.

MIME-Version

The MIME-Version field indicates the version of the standard used to structure the message. Although it is usually stable, its absence or unusual values can be signs of illegitimate sending tools.

• The most common version is 1.0.
• Its absence may indicate a non-standard transmission.
• Strange values can reveal malicious or automated software.

Content-Type

The Content-Type field defines the type of content in the message and how it should be interpreted. It is one of the most important elements for understanding the internal structure.

• It can be plain text, HTML, or multipart.
• In multipart messages, each part contains a different type of content.
• Attackers often hide malicious content in secondary parts.

Boundary

The boundary is a separator that delimits the different parts of the message when the email is multipart. It allows the message to contain several independent sections.

• It identifies where each part of the message begins and ends.
• It can reveal if the message has been manipulated.
• Inconsistent boundaries can indicate fraudulent sending tools.

Encoding

The Encoding field defines how the content is encoded for transport. It is especially relevant for attachments and non-textual content.

• The most common methods are base64 and quoted-printable.
• Malicious attachments are often encoded in base64.
• Unusual encodings can be an indicator of manipulation.

Conclusion

The MIME structure allows an email to contain multiple parts and formats. Its analysis is key to identifying hidden content, suspicious attachments, or internal manipulations. In the next article, we will delve into the message body and how to evaluate links, HTML, and embedded images to detect fraud attempts. Cuerpo del mensaje en un correo electrónico: qué se puede falsificar

The Message Body in an Email