Output

Returns output like:

[
    {
        "ipAnalysis": [
            {
                "IP": "104.245.209.248",
                "fraud_score": 87,
                "recent_abuse": true,
                "Organization": "Deft Hosting",
                "tor": false,
                "ISP": "Server Central Network",
                "recent_spam_activity": "Identified spam in the past 24-48 hours",
                "ip_sender_reputation": "Bad"
            },
            {
                "IP": "09.06.05.41",
                "recent_spam_activity": "unknown",
                "ip_sender_reputation": "unknown"
            }
        ]
    },
    {
        "spf": "pass",
        "dkim": "pass",
        "dmarc": "pass"
    }
]

IP Reputation and Email Security Analysis

This critical part of the workflow specializes in fortifying email security by extracting IP addresses from received headers. With a refined process, it analyzes the extracted IPs against the IP Quality Score API, assessing potential risks and preventing fraudulent activities.

The Extract IPs from "received" node initiates the process by isolating IP addresses from email headers, demonstrating n8n's capacity to dissect and parse complex data. The Split Out IPs node then prepares these IPs for individual scrutiny, showcasing the flexibility of n8n to handle data at granular levels. Finally, the IP Quality Score node queries an external API to evaluate each IP, reinforcing the security parameters by providing detailed risk assessments.

Authentication - Free Tier Available (5000 credits/month)

IP Quality Score uses the API key as part of the website URL. Since n8n does not currently allow for exposing credentials in the URL, you will need to hardcode your API key in the fake expression snippet in the IP Quality Score node.

The API key can be found by visiting their documentation here, logging in, and then scrolling down to the Private Key.

Workflow Overview

This n8n workflow is adept at dissecting email headers to assess security risks. It employs a webhook to receive data, then diverges into two thorough investigative paths based on specific header contents. For emails with received headers, it extracts IP details and consults the IP Quality Score API for comprehensive risk assessments, including potential fraud or abuse and geolocation insights via the IP-API.

Conversely, when authentication-results headers are present, it meticulously evaluates SPF, DKIM, and DMARC verifications, categorizing each email based on the authentication checks.

Finally, the workflow converges the data from both paths to provide a cohesive analysis, which is then relayed back through the webhook, furnishing a detailed report on IP reputation and email authentication status.

Please note that the workflow is not yet complete, but should still work without the DKIM analysis.

Triggered Via Webhook

The workflow is triggered on-demand by incoming webhook queries or can be used inside of the Execute Workflow node by replacing the webhook trigger with an Execute Workflow Trigger and the respond to webhook node with a Set node set to only keep the set node data. This allows you to use it as part of a larger workflow, in which this portion handles the header analysis. Simply add the Example input looks like:

[
  {
    "headers": {
      "host": "internal.users.n8n.cloud"
    },
    "params": {},
    "query": {},
    "body": "Delivered-To: user@example.com\nReceived: by 2002:a05:7412:be08:b0:df:2c3c:4cc with SMTP id la8csp2349351rdb;\n        Tue, 5 Sep 2023 15:06:08 -0700 (PDT)\nX-Google-Smtp-Source: AGHT+IEHz2WAE5kssnJSpwJyhbuq3ZjNQTqZfo6OFeCd5w2EKOdnF3nICb1zIL4Y1tahQpr5xY6+\nX-Received: by 2002:a17:907:78c3:b0:9a1:f2d3:ade9 with SMTP id kv3-20020a17090778c300b009a1f2d3ade9mr802685ejc.42.1693951567785;\n        Tue, 05 Sep 2023 15:06:07 -0700 (PDT)\nARC-Seal: i=1; a=rsa-sha256; t=1693951567; cv=none;\n        d=google.com; s=arc-20160816;\n        b=zsD04giTt/gbOxX6IW6/ETi7zkiuLYPaM6nYtckkcCfhqz5H7qvNN1NkDrlbnsXEr2\n         3jVLDlhAZCXVg4qGNEWTjfzLwn5eQoUdW7iy//8XZU3Xy2xtORLBKKWs+Pjzx2sBP9KS\n         zsy0Tg+rlAqi/aOH8+D+ANC0dCibsPau92zLS6GIvil700hvAJ7KB9fw0s/Ntx4z8VGv\n         0P+BodOQDO9kdHtuMkgu/waF86Xe0ImcxtvMHQ/mNjbTSRDTa0d04+X7ILVf4q0B5gFg\n         tnykE51GIS8Ey8ElAd4z/it1E/ffMJ7QAgiDSO0tZRc2NnM0QQ1oYrO9IL0cNuW1P33Q\n         PfNA==\nARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;\n        h=mime-version:date:subject:to:from:reply-to:message-id;\n        bh=f9tT4LpRqlQSioyOCLufJC57T1y2rwgsPezOJPbokDM=;\n        fh=syfPZFOxHm03Bg8T666hpPsY3BFS1EZPTr8jKyQ7bFk=;\n        b=fsZErxdmb95VXJpAyI8Pff38Ifu47WaONvSwpYaSstYbRoKDZSS3SH247NHt/+uyq+\n         7UUF37XenbcZif1p3iOa96JxcYBtLLp3cI9pe8NRQjJtceXQk70PVcCGNXORiAxoCGT+\n         iCMzUoFjTAfhK729rSldyFJ+I+WU3k+W/CjL1+geJkU5fEmg+eBEo8hDifqW3Iv73auq\n         uDnxkLZ55yX9W2ARwv/204qqqxYHKfdXDIWGDyeXE10NHLTr/GAR8DWVx6qD8b4U0Zc3\n         MC+SZxGsIcSCr5ouXIovuQBYcdmqDgDxAaN9VTfYdnXobblN6bo3OcC0rqiiyVJnV3ZA\n         BYoQ==\nARC-Authentication-Results: i=1; mx.google.com;\n       spf=fail (google.com: domain of user@example.com does not designate 89.31.72.29 as permitted sender) smtp.mailfrom=user@example.com\nReturn-Path: <user@example.com>\nReceived: from mail19.interhost.it (mail19.interhost.it. [89.31.72.29])\n        by mx.google.com with ESMTPS id k15-20020a170906578f00b00992aaed9f81si7955121ejq.356.2023.09.05.15.06.07\n        for <user@example.com>\n        (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);\n        Tue, 05 Sep 2023 15:06:07 -0700 (PDT)\nReceived-SPF: fail (google.com: domain of user@example.com does not designate 89.31.72.29 as permitted sender) client-ip=89.31.72.29;\nAuthentication-Results: mx.google.com;\n       spf=fail (google.com: domain of user@example.com does not designate 89.31.72.29 as permitted sender) smtp.mailfrom=user@example.com\nReceived: from mailfront2.interhost.it (mailfront2.interhost.it [89.31.72.21]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail19.interhost.it (Postfix) with ESMTPS id 7BA73561D21 for <user@example.com>; Wed,\n  6 Sep 2023 00:06:06 +0200 (CEST)\nReceived: from mailfront2.interhost.it (localhost [127.0.0.1]) by mailfront2.interhost.it (Postfix) with ESMTP id 5AEE1835B2 for <user@example.com>; Wed,\n  6 Sep 2023 00:06:06 +0200 (CEST)\nReceived-SPF: Pass (mailfrom) identity=mailfrom; client-ip=62.173.139.164; helo=mail.molkase.de; envelope-from=user@example.com; receiver=<UNKNOWN>\nReceived: from mail.molkase.de (mail.molkase.de [62.173.139.164]) by mailfront2.interhost.it (Postfix) with ESMTP id A8BC3835B5 for <user@example.com>; Wed,\n  6 Sep 2023 00:06:05 +0200 (CEST)\nReceived: from molkase.de (mail.molkase.de [62.173.139.164]) by mail.molkase.de (Postfix) with ESMTPA id A561D80FB872; Tue,\n  5 Sep 2023 23:08:50 +0300 (EEST)\nMessage-ID: <15404342A12424728J51235153O87748181D@ideljyzxd>\nReply-To: Legal Casino <user@example.com>\nFrom: Legal Casino <user@example.com>\nTo: <user@example.com>\nSubject: Bonus for all European residents\nDate: Tue, 05 Sep 2023 23:08:55 +0300\nMIME-Version: 1.0\nContent-Type: multipart/related; type=\"multipart/alternative\"; boundary=\"----=_NextPart_000_0018_01D9E04D.79971B70\"\nX-Virus-Scanned: ClamAV using ClamSMTP"
  }
]

IP Reputation and Fraud Analysis

This workflow section performs an in-depth reputation assessment of each IP address. The IP-API node retrieves geolocation data, while the Fraud Score node evaluates the risk associated with the IP, flagging any potential spam or abuse activities.

Consolidation of Findings

Key data points such as fraud scores and ISP information are synthesized by the Collect interesting data node, providing a clear profile of each IP for informed decision-making.

Authentication - Free Tier Available (45 requests/min)

This endpoint is limited to 45 requests per minute from an IP address.

If you go over the limit your requests will be throttled (HTTP 429) until your rate limit window is reset. If you constantly go over the limit your IP address will be banned for 1 hour.

No authentication needed, Click here to view documentation.

Analyze and Respond to Email Header Analysis

The concluding segment of the Analyze Email Headers For IPs and Spoofing workflow integrates sophisticated data processing to analyze and respond to the collected email header information. This part of the workflow is crucial as it synthesizes the data gathered from email headers and prepares it for actionable insights.

• Data Aggregation and Merging: The nodes Merge1 and Item Lists2 are pivotal for aggregating the data from previous steps. These nodes effectively concatenate various items and compile the IP analysis data. This operation is essential for creating a comprehensive view of the email headers, focusing particularly on IPs and potential spoofing indicators.

• Further Merging and Response Preparation: Another merge operation is performed by Merge3, which prepares the data for the final output. Following this, Item Lists3 further concatenates items to form a single, coherent result. This step ensures that all the relevant information is accurately compiled and ready for the final response.

• Final Response to Webhook: The Respond to Webhook node serves as the endpoint of this workflow. It is configured to respond with the analyzed data, encapsulated in a text format. The response is set to return a 200 HTTP status code, signaling a successful operation. This node exemplifies n8n's capability in not just processing and analyzing data, but also in seamlessly communicating results back to a designated receiver, be it a webhook or any other endpoint.

By the end of this workflow, you have a structured and detailed analysis of email headers, specifically tailored to identify IPs and potential spoofing threats. This underscores n8n's effectiveness as a cybersecurity tool, providing not just data processing capabilities but also actionable insights crucial for maintaining email security.

Authentication Analysis

This section assesses the presence and validity of SPF, DKIM, and DMARC records within email headers to confirm authentication. SPF/DKIM/DMARC from "authentication-results" node evaluates the authentication results, ensuring that emails meet the set security standards for sender verification.

The n8n code nodes use either a version of Javascript called node.js or a version of Python called Pyodide. In this case we are using Javascript.

SPF and DKIM Authentication Routing

This group of nodes orchestrates the authentication status routing for SPF and DKIM records found in email headers.

SPF Validation Decision-Making The SPF switch node evaluates the SPF results from the email header, directing the flow to different paths based on whether SPF passes, fails, or is neutral. The "Set1," "Set2," and "Set4" nodes then assign the respective SPF authentication statuses, marking emails for further processing based on their security verification.

DKIM Evaluation Handling Although not explicitly processing DKIM, the "DKIM" switch node is likely misnamed and should be adjusted to reflect its role correctly. It seems to be set up for similar routing logic as the SPF node, which suggests it should handle DKIM results. If it's indeed for DKIM, ensure it's checking for "dkim=pass/fail/neutral" within the authentication results.

Unknown SPF Status Assignment Finally, the "Set5" node appears to handle cases where SPF results are not found or are indeterminate, setting the status to "unknown."

Email Authentication Assessment

This set of nodes is dedicated to evaluating the authentication of email headers, specifically focusing on SPF, DKIM, and DMARC validations.

SPF, DKIM, and DMARC Extraction

Starting with SPF from 'received-spf', this node analyzes the email's SPF records for compliance. Following this, DKIM from 'dkim-signature' examines the DKIM signatures to verify their presence and status. Next, DMARC from 'received-dmarc' checks DMARC records for alignment with expected security practices.

Data Aggregation

Once the assessments are complete, Aggregate Authentication Data compiles the findings into a cohesive dataset, providing clear indicators of each email's authentication status.

Key Focus

These nodes are essential in filtering out potentially harmful emails by verifying their authenticity, a key step in protecting against phishing and spoofing attempts.

Analyze_email_headers_for_IPs_and_spoofing__3

Purpose and structure

This folder contains the Analyze_email_headers_for_IPs_and_spoofing__3 workflow. Its executable nodes use code, httpRequest, if, itemLists, merge, respondToWebhook, set, switch, webhook. The table and connection map below are derived from the JSON, not an inferred guarantee of behavior.

Setup

Import inactive. Configure your own credentials and replace REPLACE_WITH_* values. Review external destinations and Code nodes before running.

Entry points

Receive Headers

Verification

Sanitized source candidate; not runtime-tested. This overview is generated from node metadata. Read the folder README for the connection map, credential types, and license.

Attribution

https://github.com/Zie619/n8n-workflows/blob/94007c1445d9258a7da116646b79473e7c7c3282/workflows/Code/0946_Code_Webhook_Send_Webhook.json MIT; preserve source notices.