Update header_analyzer.py

header_analyzer.py

@@ -3,40 +3,53 @@ import re
 def analyze_headers(headers):
     findings = []
     score = 0
+    headers = headers or {}
 
-    # --- 1. SPF / DKIM / DMARC checks ---
-    auth_results = headers.get("Authentication-Results", "")
-    if "dkim=fail" in auth_results.lower() or "dkim=permerror" in auth_results.lower():
+    # 1) SPF / DKIM / DMARC
+    auth_results = (headers.get("Authentication-Results") or "").lower()
+    if "dkim=fail" in auth_results or "dkim=permerror" in auth_results:
         findings.append("Header: DKIM check failed")
         score += 25
-    if "spf=fail" in auth_results.lower():
+    if "spf=fail" in auth_results:
         findings.append("Header: SPF check failed")
         score += 25
-    if "dmarc=fail" in auth_results.lower():
+    if "dmarc=fail" in auth_results:
         findings.append("Header: DMARC check failed")
         score += 25
 
-    # --- 2. From / Reply-To mismatch ---
-    from_addr = headers.get("From", "")
-    reply_to = headers.get("Reply-To", "")
-    if reply_to and reply_to not in from_addr:
-        findings.append(f"Header: Reply-To mismatch (From: {from_addr}, Reply-To: {reply_to})")
-        score += 20
+    # softer signals
+    if any(x in auth_results for x in ["spf=softfail", "spf=neutral", "spf=none"]):
+        findings.append("Header: SPF not properly aligned")
+        score += 10
+    if any(x in auth_results for x in ["dmarc=temperror", "dkim=temperror"]):
+        findings.append("Header: Temporary auth errors (DKIM/DMARC)")
+        score += 5
 
-    # --- 3. Suspicious sender domain ---
-    sender = headers.get("From", "")
+    # 2) From / Reply-To mismatch (domain-level)
+    from_addr = headers.get("From", "") or ""
+    reply_to = headers.get("Reply-To", "") or ""
+    from_domain = re.search(r'@([a-zA-Z0-9.-]+)', from_addr)
+    reply_domain = re.search(r'@([a-zA-Z0-9.-]+)', reply_to)
+    if from_domain and reply_domain:
+        if from_domain.group(1).lower() != reply_domain.group(1).lower():
+            findings.append(f"Header: Reply-To domain mismatch (From: {from_domain.group(1)}, Reply-To: {reply_domain.group(1)})")
+            score += 20
+
+    # 3) Suspicious sender domain
+    sender = headers.get("From", "") or ""
     match = re.search(r'@([a-zA-Z0-9.-]+)', sender)
     if match:
         domain = match.group(1).lower()
+        parts = domain.split(".")
         if any(free in domain for free in ["gmail.com", "yahoo.com", "outlook.com"]):
             findings.append(f"Header: Free email provider used ({domain})")
             score += 10
-        if len(domain.split(".")) > 3 or any(char.isdigit() for char in domain.split(".")[0]):
+        if len(parts) > 4 or (parts and any(char.isdigit() for char in parts[0])):
             findings.append(f"Header: Suspicious-looking domain ({domain})")
             score += 15
 
-    # --- 4. BCC usage ---
-    if "bcc" in headers:
+    # 4) BCC usage (note: often stripped)
+    if headers.get("Bcc"):
         findings.append("Header: Email sent with BCC (common in mass phishing)")
         score += 15