Update header_analyzer.py

header_analyzer.py

@@ -5,7 +5,6 @@ import whois
 from datetime import datetime
 from email.utils import parseaddr
 
-# Known brands (expandable)
 BRAND_OFFICIAL = {
     "paypal": ["paypal.com"],
     "amazon": ["amazon.com"],
@@ -15,7 +14,6 @@ BRAND_OFFICIAL = {
 }
 
 SUSPICIOUS_TLDS = {"xyz", "top", "click", "work", "loan", "tk", "zip", "mov"}
-
 FREE_EMAIL_PROVIDERS = {
     "gmail.com", "yahoo.com", "outlook.com", "hotmail.com", "icloud.com"
 }
@@ -41,49 +39,52 @@ def _domain_age_days(domain: str):
 
 
 def analyze_headers(headers: dict, body: str = ""):
-    """
-    Returns:
-      findings: list[str]
-      score: int
-      auth_summary: str
-    """
     findings = []
     score = 0
     headers = headers or {}
     body_l = (body or "").lower()
 
-    # =========================
-    # AUTHENTICATION RESULTS
-    # =========================
     auth_header = (
         headers.get("Authentication-Results")
         or headers.get("Authentication-results")
         or ""
     ).lower()
 
+    auth_results = {
+        "spf": "unknown",
+        "dkim": "unknown",
+        "dmarc": "unknown",
+    }
+
     auth_summary = []
 
     if "spf=fail" in auth_header:
         findings.append("Header: SPF authentication failed")
+        auth_results["spf"] = "fail"
         auth_summary.append("SPF failed")
         score += 25
+    elif "spf=pass" in auth_header:
+        auth_results["spf"] = "pass"
 
     if "dkim=fail" in auth_header or "dkim=permerror" in auth_header:
         findings.append("Header: DKIM authentication failed")
+        auth_results["dkim"] = "fail"
         auth_summary.append("DKIM failed")
         score += 25
+    elif "dkim=pass" in auth_header:
+        auth_results["dkim"] = "pass"
 
     if "dmarc=fail" in auth_header:
         findings.append("Header: DMARC authentication failed")
+        auth_results["dmarc"] = "fail"
         auth_summary.append("DMARC failed")
         score += 30
+    elif "dmarc=pass" in auth_header:
+        auth_results["dmarc"] = "pass"
 
     if not auth_summary:
         auth_summary.append("No strong authentication failures detected")
 
-    # =========================
-    # FROM / REPLY-TO ANALYSIS
-    # =========================
     from_domain = _extract_domain(headers.get("From", ""))
     reply_domain = _extract_domain(headers.get("Reply-To", ""))
 
@@ -93,47 +94,29 @@ def analyze_headers(headers: dict, body: str = ""):
         )
         score += 35
 
-    # =========================
-    # BEC INDICATORS
-    # =========================
-    if from_domain and from_domain in FREE_EMAIL_PROVIDERS:
+    if from_domain in FREE_EMAIL_PROVIDERS:
         findings.append(f"Header: Free email provider used ({from_domain})")
         score += 15
 
     if any(k.lower() in headers for k in ["bcc", "cc"]) and not headers.get("To"):
-        findings.append("Header: Possible BEC — missing To field with CC/BCC usage")
+        findings.append("Header: Possible BEC — CC/BCC without To header")
         score += 20
 
-    if body_l and any(
-        x in body_l for x in ["wire transfer", "urgent payment", "bank details"]
-    ):
-        findings.append("Header/Body: Financial request detected (BEC pattern)")
+    if any(x in body_l for x in ["wire transfer", "urgent payment", "bank details"]):
+        findings.append("Header/Body: Financial request pattern (BEC)")
         score += 35
 
-    # =========================
-    # DOMAIN REPUTATION
-    # =========================
     if from_domain:
         tld = from_domain.split(".")[-1]
-
         if tld in SUSPICIOUS_TLDS:
             findings.append(f"Header: Suspicious TLD used ({tld})")
             score += 20
 
         age = _domain_age_days(from_domain)
         if age is not None and age < 90:
-            findings.append(
-                f"Header: Sender domain is very new ({age} days old)"
-            )
+            findings.append(f"Header: Sender domain very new ({age} days)")
             score += 30
 
-        if len(from_domain.split(".")) > 4:
-            findings.append("Header: Excessive subdomains detected")
-            score += 15
-
-    # =========================
-    # BRAND / LOOK-ALIKE SPOOFING
-    # =========================
     for brand, legit_domains in BRAND_OFFICIAL.items():
         if brand in from_domain:
             if not any(from_domain.endswith(ld) for ld in legit_domains):
@@ -150,6 +133,9 @@ def analyze_headers(headers: dict, body: str = ""):
                 )
                 score += 40
 
-    score = int(min(score, 100))
+    score = min(score, 100)
 
-    return findings, score, ", ".join(auth_summary)
+    return findings, score, {
+        "summary": ", ".join(auth_summary),
+        "results": auth_results,
+    }