Sample EML file (spoofed display name)

Handle it in code

Each snippet below was run against this exact file with Python 3.14.4 and Node 24.15.0 when this page was built, and the output shown is what it printed.

Python

Parse with the modern email API (policy=default): it decodes encoded headers and bodies, and get_body picks the readable part. Treat attachment names as hostile: keep only the base name, replace unusual characters, and refuse names that run as programs. Compare the display name with the real address too, the oldest spoofing trick there is.

import email
import re
from email import policy
from email.utils import parseaddr

RUNS = (".exe", ".scr", ".bat", ".cmd", ".com", ".js", ".vbs", ".ps1", ".msi", ".jar", ".lnk")

with open("spoofed-display-name.eml", "rb") as f:
    msg = email.message_from_binary_file(f, policy=policy.default)

name, addr = parseaddr(str(msg["From"] or ""))
print("from:", addr or "(missing)", "| subject:", msg["Subject"] or "(missing)")
for header in ("Date", "Message-ID"):
    if msg[header] is None:
        print(f"warning: no {header} header")
if "@" in name and parseaddr(name)[1].lower() != addr.lower():
    print(f"warning: display name {name!r} is not the real sender")

body = msg.get_body(preferencelist=("plain", "html"))
text = body.get_content().strip() if body else ""
print(f"body: {body.get_content_type() if body else '(none)'} {text[:50]!r}")

for part in msg.iter_attachments():
    kind = part.get_content_type()
    if kind == "message/rfc822":
        print("attached message:", part.get_content()["Subject"])
        continue
    raw = part.get_filename() or ""
    base = raw.replace("\\", "/").rsplit("/", 1)[-1]
    safe = re.sub(r"[^\w.\- ]", "_", base).strip(". ") or "attachment"
    verdict = "blocked, it runs as a program" if safe.lower().endswith(RUNS) else "save as " + repr(safe)
    print(f"attachment: {kind} {raw!r}: {verdict}")
    if kind == "application/ms-tnef":
        print("  Outlook's TNEF wrapper: the real attachments are inside it")

Run against this file, it prints: from: attacker@evil.example.test | subject: Action required: verify your account warning: display name 'support@yourbank.example' is not the real sender body: text/plain 'This is a harmless test fixture, not a real phishi'