For anyone that's ever tried, there's no 'one way' to parse email, it's one of those long standing protocols that was developed during a different period of time, is extremely resilient, can carry just about anything, works across different encodings, systems and will do just about anything you want it to. The very thing that makes it so versatile- is the very thing that makes it extremely difficult to parse- well. Transporting email is easy, most of the headers and other implementation details in the RFC define that pretty well. It's what IN the messages that's important (and hard)....

I've been writing threat intel parsers for over a decade. In fact, i've made a pretty decent living at it, and i've pretty much seen it all- illegal XML, JSON with XML in it, CSV with tabs in it, pipe delimited 'CSV' with tabs in it and plain text that looks like .. it was written by my 3y/o son....

One of these things is not like the other...

I am a trader.

Not in the Wolf of Wall-Street sense (hookers and blow really aren't my thing), but in the “I make about 3,000 trades a year against my house and my family’s future” kind of sense. I’m part of a growing segment of the population that sees things in the world- then immediately checks the volatility futures to see whether “the community” is freaking out over something that most of the world truly cares about (eg: are people selling this news?).....

It's one thing to think of "statistics" in the general sense. For instance,

"100 unique IPs scanned my darknet today".

This doesn't really tell me anything useful, other than (assuming DHCP churn is nil in a given 24 hour period) there's a bit of noise on the line. 100 by itself isn't a really useful number, it's probably not even statistically relevant, is it a holiday? was part of the Internet down today? was it the same device behind a series of NATs?....