Update header_analyzer.py

header_analyzer.py

@@ -16,52 +16,65 @@ BRAND_OFFICIAL = {
 # Suspicious / cheap TLDs often abused
 SUSPICIOUS_TLDS = {"info", "xyz", "top", "click", "work", "loan", "tk"}
 
+
 def get_domain_age_days(domain: str):
     """Return domain age in days (or None if lookup fails)."""
     try:
         w = whois.whois(domain)
         creation_date = w.creation_date
-        if isinstance(creation_date, list):  # sometimes returns list
+
+        # Handle weird formats
+        if isinstance(creation_date, list) and creation_date:
             creation_date = creation_date[0]
-        if creation_date:
+        if isinstance(creation_date, str):
+            try:
+                creation_date = datetime.fromisoformat(creation_date)
+            except Exception:
+                creation_date = None
+
+        if creation_date and isinstance(creation_date, datetime):
             return (datetime.now() - creation_date).days
-    except Exception:
+    except Exception as e:
+        # Do not crash if WHOIS fails on Hugging Face
+        print(f"[WHOIS ERROR] Could not fetch age for {domain}: {e}")
         return None
     return None
 
+
 def parse_auth_results(auth_header: str):
     """
     Parse the Authentication-Results header and return a readable summary.
     """
     auth_header = (auth_header or "").lower()
     findings = []
-    
+
     if not auth_header:
         return "No Authentication-Results header found"
-    
+
     # SPF
     if "spf=pass" in auth_header:
         findings.append("SPF passed")
     elif "spf=fail" in auth_header:
         findings.append("SPF failed")
-    
+
     # DKIM
     if "dkim=pass" in auth_header:
         findings.append("DKIM passed")
     elif "dkim=fail" in auth_header or "dkim=permerror" in auth_header:
         findings.append("DKIM failed")
-    
+
     # DMARC
     if "dmarc=pass" in auth_header:
         findings.append("DMARC passed")
     elif "dmarc=fail" in auth_header:
         findings.append("DMARC failed")
-    
+
     if not findings:
         return "Authentication results unclear or missing"
-    
+
     return ", ".join(findings)
 
+
 def analyze_headers(headers, body=""):
     """
     Input: headers dict, optional body text
@@ -126,7 +139,7 @@ def analyze_headers(headers, body=""):
             findings.append(f"Header: Suspicious/abused TLD used ({tld})")
             score += 20
 
-        # Domain age check
+        # Domain age check (robust)
         age_days = get_domain_age_days(from_domain)
         if age_days is not None and age_days < 90:
             findings.append(f"Header: Domain {from_domain} is very new ({age_days} days old)")