Posts to Slack when new mail links to a site outside your expected list, with how recently that site was registered and who runs it.
Uses
Gmail
IPWHOIS.io
RDAP
Slack
Flag emails that link to unfamiliar websites
Whenever new mail arrives, the messages your Gmail search matches are read and one Slack note per message lists the hosts their links point to. Hosts on your list of expected domains, your own and your suppliers', are left out, so what reaches Slack is mail linking somewhere you did not expect.
For each host the note gives what the public registry holds: when the name was registered, how many days ago, and the registrar, or for a bare numeric address, who runs it and in which country. It also flags a link over plain http, a name in punycode, and a link on the sender's own domain. It reports and does not conclude: nothing says whether a link is worth opening, and no address is ever visited. Only the host part of a link is used, and a report that would repeat a full web address is withheld. Each message is labelled once read, so nothing is reported twice.
You need a Slack channel, a Gmail search naming the mail to read, and a list of the domains you already expect.
GmailWhen an email arrives.When an email arrives.
Set mailSearch to blank.Set mailSearch to blank.Set slackChannelId to blank.Set slackChannelId to blank.Set expectedDomains to blank.Set expectedDomains to blank.Set checkedLabel to Links checked.Set checkedLabel to Links checked.Set maxMessagesPerRun to 10.Set maxMessagesPerRun to 10.Set maxHostsPerMessage to 10.Set maxHostsPerMessage to 10.
Join a list of [mailSearch, -label:, @checkedLabel, linkQuery.Join a list of [mailSearch, -label:, @checkedLabel, linkQuery.
Set messageLimit to maxMessagesPerRun multiplied by 1.Set messageLimit to maxMessagesPerRun multiplied by 1.Set hostLimit to maxHostsPerMessage multiplied by 1.Set hostLimit to maxHostsPerMessage multiplied by 1.Split expectedDomains with "Split expectedDomains with
replaced by , with replaced by , and save it as expectedList.GmailList emails matching linkQuery. Save it as arrived.List emails matching linkQuery. Save it as arrived.Set readCount to 0.Set readCount to 0.Set postCount to 0.Set postCount to 0.
For each message in arrived.emails:For each message in arrived.emails:
If readCount is greater than or equal to messageLimitIf readCount is greater than or equal to messageLimitYes
Stop repeating.Stop repeating.No
No steps
If a step below fails, save the error as readErrorIf a step below fails, save the error as readErrorTry
Trim message.id and save it as messageId.Trim message.id and save it as messageId.If messageId is emptyIf messageId is emptyYes
Skip to the next item.Skip to the next item.No
No steps
Trim message.from and save it as fromHeader.Trim message.from and save it as fromHeader.Set addressPart to fromHeader.Set addressPart to fromHeader.If fromHeader contains <If fromHeader contains <Yes
Get the first item of the last item of fromHeader split by < split by > and save it as addressPart.Get the first item of the last item of fromHeader split by < split by > and save it as addressPart.No
No steps
Make the last item of addressPart split by @ lowercase and save it as senderDomain.Make the last item of addressPart split by @ lowercase and save it as senderDomain.Set subject to (no subject).Set subject to (no subject).If a step below fails, save the error as subjectMissingIf a step below fails, save the error as subjectMissingTry
Trim message.subject and save it as subjectText.Trim message.subject and save it as subjectText.If subjectText isn't empty and subjectText is not nullIf subjectText isn't empty and subjectText is not nullYes
Change subject to subjectText.Change subject to subjectText.No
No steps
On error
Show in the output: A message arrived with no subject..Show in the output: A message arrived with no subject..Set bodyText to blank.Set bodyText to blank.If a step below fails, save the error as bodyMissingIf a step below fails, save the error as bodyMissingTry
Trim message.body and save it as bodyValue.Trim message.body and save it as bodyValue.If bodyValue is not nullIf bodyValue is not nullYes
Change bodyText to bodyValue.Change bodyText to bodyValue.No
No steps
On error
Show in the output: A message arrived with no readable text..Show in the output: A message arrived with no readable text..Start an empty list and save it as seenHosts.Start an empty list and save it as seenHosts.Start an empty list and save it as hostLines.Start an empty list and save it as hostLines.Set hostCount to 0.Set hostCount to 0.For each linkUrl in all web addresses in bodyText:For each linkUrl in all web addresses in bodyText: If hostCount is greater than or equal to hostLimit If hostCount is greater than or equal to hostLimitYes
Stop repeating.Stop repeating.No
No steps
Trim linkUrl and save it as urlText. Trim linkUrl and save it as urlText. Check whether urlText starts with http:// (ignoring case) and save it as plainHttp. Check whether urlText starts with http:// (ignoring case) and save it as plainHttp. Join the items from index 1 onward of urlText split by :// with :// and save it as afterScheme. Join the items from index 1 onward of urlText split by :// with :// and save it as afterScheme. Get the first item of afterScheme split by / and save it as hostPart. Get the first item of afterScheme split by / and save it as hostPart. Get the first item of hostPart split by ? and save it as hostPart. Get the first item of hostPart split by ? and save it as hostPart. Get the first item of hostPart split by # and save it as hostPart. Get the first item of hostPart split by # and save it as hostPart. Get the last item of hostPart split by @ and save it as hostPart. Get the last item of hostPart split by @ and save it as hostPart. Get the first item of hostPart split by : and save it as hostPart. Get the first item of hostPart split by : and save it as hostPart. Make hostPart lowercase and save it as linkHost. Make hostPart lowercase and save it as linkHost. If linkHost is empty or linkHost doesn't contain . or linkHost contains : or… If linkHost is empty or linkHost doesn't contain . or linkHost contains : or…Yes
Skip to the next item.Skip to the next item.No
No steps
If seenHosts contains linkHost If seenHosts contains linkHostYes
Skip to the next item.Skip to the next item.No
No steps
Add linkHost to the end of seenHosts and save it as seenHosts. Add linkHost to the end of seenHosts and save it as seenHosts. Set expected to false. Set expected to false. For each allowed in expectedList: For each allowed in expectedList: Trim allowed and save it as allowedName. Trim allowed and save it as allowedName. If allowedName is empty or allowedName is null If allowedName is empty or allowedName is nullYes
Skip to the next item.Skip to the next item.No
No steps
If linkHost is allowedName or linkHost ends with .@allowedName If linkHost is allowedName or linkHost ends with .@allowedNameYes
Change expected to true.Change expected to true.Stop repeating.Stop repeating.No
No steps
If expected is yes If expected is yesYes
Skip to the next item.Skip to the next item.No
No steps
Add 1 to hostCount. Add 1 to hostCount. Set notes to blank. Set notes to blank. If plainHttp is yes If plainHttp is yesYes
Change notes to notes [linked over plain http].Change notes to notes [linked over plain http].No
No steps
If linkHost starts with xn-- or linkHost contains .xn-- If linkHost starts with xn-- or linkHost contains .xn--Yes
Change notes to notes [the name is written in punycode, xn--].Change notes to notes [the name is written in punycode, xn--].No
No steps
If linkHost is senderDomain or linkHost ends with .@senderDomain If linkHost is senderDomain or linkHost ends with .@senderDomainYes
Change notes to notes [on the sender's own domain].Change notes to notes [on the sender's own domain].No
No steps
Set factText to nothing was looked up for this host.. Set factText to nothing was looked up for this host.. If the first match in linkHost isn't empty If the first match in linkHost isn't emptyYes
If a step below fails, save the error as ipErrorIf a step below fails, save the error as ipErrorTry
IPWHOIS.ioGet the network operator of linkHost. Save it as net.Get the network operator of linkHost. Save it as net.Trim net.isp and save it as isp.Trim net.isp and save it as isp.Trim net.autonomous_system and save it as asn.Trim net.autonomous_system and save it as asn.Trim net.country and save it as country.Trim net.country and save it as country.Join a list of [the link names an address rather than a name; the registry for that address records , isp, , , asn, , , country, .] with nothing and save it as factText.Join a list of [the link names an address rather than a name; the registry for that address records , isp, , , asn, , , country, .] with nothing and save it as factText.On error
Change factText to the link names an address rather than a name, and the lookup for that address did not complete..Change factText to the link names an address rather than a name, and the lookup for that address did not complete..No
If a step below fails, save the error as registryErrorIf a step below fails, save the error as registryErrorTry
RDAPLook up domain linkHost. Save it as registry.Look up domain linkHost. Save it as registry.Set record to registry.result.Set record to registry.result.Trim record.registration_date and save it as registeredOn.Trim record.registration_date and save it as registeredOn.Trim record.registrar and save it as registrar.Trim record.registrar and save it as registrar.Change factText to the registry returned no registration date for this name..Change factText to the registry returned no registration date for this name..If registeredOn isn't empty and registeredOn is not nullIf registeredOn isn't empty and registeredOn is not nullYes
Set ageText to blank.Set ageText to blank.If a step below fails, save the error as ageErrorIf a step below fails, save the error as ageErrorTry
Join a list of [, , the difference between registeredOn and today's date in days as text, days ago] with nothing and save it as ageText.Join a list of [, , the difference between registeredOn and today's date in days as text, days ago] with nothing and save it as ageText.On error
Change ageText to blank.Change ageText to blank.Join a list of [the registry records this name as registered on , the first item of registeredOn split by T, ageText, .] with nothing and save it as factText.Join a list of [the registry records this name as registered on , the first item of registeredOn split by T, ageText, .] with nothing and save it as factText.If registrar isn't empty and registrar is not nullIf registrar isn't empty and registrar is not nullYes
Join a list of [factText, Registrar of record: , registrar, .] with nothing and save it as factText.Join a list of [factText, Registrar of record: , registrar, .] with nothing and save it as factText.No
No steps
No
No steps
On error
Change factText to the registry lookup for this name did not complete..Change factText to the registry lookup for this name did not complete.. Add a list of [- , linkHost, notes, - , factText] joined by nothing to the end of hostLines and save it as hostLines. Add a list of [- , linkHost, notes, - , factText] joined by nothing to the end of hostLines and save it as hostLines.If hostLines isn't emptyIf hostLines isn't emptyYes
Join a list of [a list of ["Links in mail that just arrivedJoin a list of [a list of [Links in mail that just arrived
From: , fromHeader truncated to 120 characters using ... as the ellipsis,
Subject: , subject truncated to 120 characters using ... as the ellipsis] joined by nothing, hostLines joined by a new line, Only the host part of each link is shown, and only hosts that are not on your 'expectedDomains' list. None of these lookups says what a link is - they report what the public registry holds about a name, and nothing more. A name with nothing on record is a name with nothing on record. Nothing here has visited any of these addresses.] with a blank line and save it as report.For each reportLink in all web addresses in report:For each reportLink in all web addresses in report: Replace reportLink with [link removed] in report and save it as report. Replace reportLink with [link removed] in report and save it as report.If report contains ://If report contains ://Yes
Change report to A message arrived carrying links to hosts outside your expected domains, but the report could not be written without repeating a web address from the message. Open the message in the mailbox instead..Change report to A message arrived carrying links to hosts outside your expected domains, but the report could not be written without repeating a web address from the message. Open the message in the mailbox instead..No
No steps
SlackSend a message to slackChannelId.Send a message to slackChannelId.reportAdd 1 to postCount.Add 1 to postCount.No
Show in the output: a list of [Message , messageId, linked to nothing outside your expected domains, or its text held no web addresses.] joined by nothing.Show in the output: a list of [Message , messageId, linked to nothing outside your expected domains, or its text held no web addresses.] joined by nothing.GmailAdd label checkedLabel to email messageId.Add label checkedLabel to email messageId.Add 1 to readCount.Add 1 to readCount.On error
Show in the output: Could not read the links out of one message: readError as text.Show in the output: Could not read the links out of one message: readError as text.Show in the output: a list of [Messages read: , readCount as text, , reports posted: , postCount as text] joined by nothing.Show in the output: a list of [Messages read: , readCount as text, , reports posted: , postCount as text] joined by nothing.