8
n8n 中文网amn8n.com

分析Outlook邮件头以检测IP信誉和欺骗

高级

这是一个SecOps领域的自动化工作流，包含 41 个节点。主要使用 If, Set, Code, Limit, Merge 等节点。 分析Outlook邮件头以检测IP信誉和欺骗

前置要求
  • •HTTP Webhook 端点（n8n 会自动生成）
  • •可能需要目标 API 的认证凭证

使用的节点 (41)

If
Set
Code
NoOp
Limit
Merge
Webhook
Aggregate
StickyNote
HttpRequest
RespondToWebhook
MicrosoftOutlookTrigger

分类

安全运维
工作流预览
可视化展示节点连接关系，支持缩放和平移
React Flow
导出工作流
复制以下 JSON 配置到 n8n 导入，即可使用此工作流
{
  "meta": {
    "instanceId": "03e9d14e9196363fe7191ce21dc0bb17387a6e755dcc9acc4f5904752919dca8"
  },
  "nodes": [
    {
      "id": "363be6de-5e8d-46b2-a31f-6f7bc204c986",
      "name": "新邮件触发",
      "type": "n8n-nodes-base.microsoftOutlookTrigger",
      "disabled": true,
      "position": [
        -760,
        1400
      ],
      "parameters": {
        "output": "raw",
        "filters": {
          "foldersToInclude": [
            "AQMkADM5MWVmZWEwLTQ4OTMtNGMyYy1iOWUxLTQ4N2M1YmU0ODJjNQAuAAADWJOZOf0oRkGpsGIMN2VBCwEAbttrza1gUEiEMFJJPqIeZQAAAgEMAAAA"
          ]
        },
        "options": {},
        "pollTimes": {
          "item": [
            {
              "mode": "everyMinute"
            }
          ]
        }
      },
      "credentials": {
        "microsoftOutlookOAuth2Api": {
          "id": "vTCK0oVQ0WjFrI5H",
          "name": "Outlook Credential"
        }
      },
      "typeVersion": 1
    },
    {
      "id": "0da8b1ab-6dbe-41b7-92f1-6e8637d082cb",
      "name": "检索邮件头",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        -560,
        1400
      ],
      "parameters": {
        "url": "=https://graph.microsoft.com/v1.0/me/messages/{{ $json.id }}?$select=internetMessageHeaders",
        "options": {},
        "sendHeaders": true,
        "authentication": "predefinedCredentialType",
        "headerParameters": {
          "parameters": [
            {
              "name": "Accept",
              "value": "application/json"
            }
          ]
        },
        "nodeCredentialType": "microsoftOutlookOAuth2Api"
      },
      "credentials": {
        "microsoftOutlookOAuth2Api": {
          "id": "vTCK0oVQ0WjFrI5H",
          "name": "Outlook Credential"
        }
      },
      "typeVersion": 4.2
    },
    {
      "id": "2f28e47d-f010-4f0b-bbe4-074bbdf39a45",
      "name": "提取接收头",
      "type": "n8n-nodes-base.code",
      "position": [
        80,
        1460
      ],
      "parameters": {
        "jsCode": "// Extract the headers array from the JSON\nconst headers = $('Set Headers').item.json.headers;\n\n// Filter headers where the name is \"Received\"\nconst receivedHeaders = headers.filter(header => header.name === \"Received\");\n\n// Return the filtered headers\nreturn receivedHeaders;\n"
      },
      "executeOnce": false,
      "typeVersion": 2
    },
    {
      "id": "530fd9c3-94c2-4d5e-a686-57738cc10ae6",
      "name": "移除额外接收头",
      "type": "n8n-nodes-base.limit",
      "position": [
        300,
        1460
      ],
      "parameters": {
        "keep": "lastItems"
      },
      "typeVersion": 1
    },
    {
      "id": "9942704e-e0ac-42e9-b714-b2bdb3117c02",
      "name": "提取原始发件人 IP",
      "type": "n8n-nodes-base.set",
      "position": [
        500,
        1460
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": [
            {
              "id": "5f740d1f-de62-4fe0-aa20-625063344c07",
              "name": "extractedfromip",
              "type": "string",
              "value": "={{ $json.value.replace(/\\b(127\\.(?:\\d{1,3}\\.){2}\\d{1,3})|(10\\.(?:\\d{1,3}\\.){2}\\d{1,3})|(172\\.(?:1[6-9]|2[0-9]|3[0-1])\\.\\d{1,3}\\.\\d{1,3})|(192\\.168\\.\\d{1,3}\\.\\d{1,3})\\b/g, \"\").match(/(\\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(\\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(\\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(\\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(\\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(\\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(\\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(\\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}))|:)))(%.+)?\\s*)|(\\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)[.]){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\b)/)[0] }}"
            }
          ]
        }
      },
      "typeVersion": 3.4
    },
    {
      "id": "6093bcd2-1101-4685-8d2c-751dd451afc4",
      "name": "查询 IP 质量评分 API",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        980,
        1360
      ],
      "parameters": {
        "url": "=https://ipqualityscore.com/api/json/ip/Mlg6aZdzI1mVehUD3Z5Ak5Vl4yNN7P8v/{{ $('Extract Original From IP').item.json.extractedfromip }}?strictness=1&allow_public_access_points=true&lighter_penalties=true",
        "options": {}
      },
      "typeVersion": 4.2
    },
    {
      "id": "feb4203c-4f9b-456c-9640-82ce8f6f550f",
      "name": "查询 IP API",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        1180,
        1360
      ],
      "parameters": {
        "url": "=http://ip-api.com/json/{{ $('Extract Original From IP').item.json.extractedfromip }}",
        "options": {}
      },
      "typeVersion": 4.2
    },
    {
      "id": "f628e421-4cb5-4612-83c2-bde0f4f57367",
      "name": "Authentication-Results 头？",
      "type": "n8n-nodes-base.if",
      "position": [
        1440,
        1600
      ],
      "parameters": {
        "options": {},
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "ead2b640-ad80-4189-a692-ae454723fd85",
              "operator": {
                "type": "boolean",
                "operation": "true",
                "singleValue": true
              },
              "leftValue": "={{ $('Set Headers').item.json.headers.some(header => header.name === \"Authentication-Results\") }}",
              "rightValue": "true"
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "8616ecd3-1c71-49ff-a32c-4b09f3214edb",
      "name": "提取 Authentication-Results 头",
      "type": "n8n-nodes-base.code",
      "position": [
        1720,
        1360
      ],
      "parameters": {
        "jsCode": "// Extract the headers array from the JSON\nconst headers = $('Set Headers').item.json.headers;\n\n// Filter headers where the name is \"Received\"\nconst receivedHeaders = headers.filter(header => header.name === \"Authentication-Results\");\n\n// Return the filtered headers\nreturn receivedHeaders;\n"
      },
      "executeOnce": false,
      "typeVersion": 2
    },
    {
      "id": "7d3a37dc-6bbe-4c3b-9c2c-c9d2c1c24213",
      "name": "Received-SPF 头？",
      "type": "n8n-nodes-base.if",
      "position": [
        1700,
        2220
      ],
      "parameters": {
        "options": {},
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "a38ebc9b-f896-4432-81fb-4f3db98f3409",
              "operator": {
                "type": "boolean",
                "operation": "true",
                "singleValue": true
              },
              "leftValue": "={{ $('Set Headers').item.json.headers.some(header => header.name === \"Received-SPF\") }}",
              "rightValue": ""
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "f1ca55fb-07d8-4825-8850-f5a3c58e358a",
      "name": "DKIM-Signature 头？",
      "type": "n8n-nodes-base.if",
      "position": [
        1700,
        2620
      ],
      "parameters": {
        "options": {},
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "a38ebc9b-f896-4432-81fb-4f3db98f3409",
              "operator": {
                "type": "boolean",
                "operation": "true",
                "singleValue": true
              },
              "leftValue": "={{ $('Set Headers').item.json.headers.some(header => header.name === \"DKIM-Signature\") }}",
              "rightValue": ""
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "df19f38c-b263-4b97-bd22-adc8ff44f631",
      "name": "设置 SPF 值",
      "type": "n8n-nodes-base.set",
      "position": [
        2480,
        2140
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": [
            {
              "id": "179c48eb-97e5-48ab-82b8-ef4269f11366",
              "name": "spfvalue",
              "type": "string",
              "value": "={{ $json.data.last().value.toLowerCase().includes('fail') ? \"fail\" : $json.data.last().value.toLowerCase().includes('pass') ? \"pass\" : \"unknown\"}}"
            }
          ]
        }
      },
      "typeVersion": 3.4
    },
    {
      "id": "1613d276-3ec4-44b2-91ca-f76985e1b4c2",
      "name": "提取 Received-SPF 头",
      "type": "n8n-nodes-base.code",
      "position": [
        1940,
        2140
      ],
      "parameters": {
        "jsCode": "// Extract the headers array from the JSON\nconst headers = $('Set Headers').item.json.headers;\n\n// Filter headers where the name is \"Received\"\nconst receivedHeaders = headers.filter(header => header.name === \"Received-SPF\");\n\n// Return the filtered headers\nreturn receivedHeaders;\n"
      },
      "executeOnce": false,
      "typeVersion": 2
    },
    {
      "id": "47697f60-99e7-4c91-ab7c-7f966b1b5307",
      "name": "找到 DKIM 签名",
      "type": "n8n-nodes-base.set",
      "position": [
        2480,
        2520
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": [
            {
              "id": "ae3158bf-3d91-4a61-a58c-c151362e52d7",
              "name": "dkimvalue",
              "type": "string",
              "value": "=found"
            }
          ]
        }
      },
      "typeVersion": 3.4
    },
    {
      "id": "2383e7b4-fe13-4c36-80a3-67ba3f02ce1d",
      "name": "DMARC 头？",
      "type": "n8n-nodes-base.if",
      "position": [
        1700,
        3060
      ],
      "parameters": {
        "options": {},
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "a38ebc9b-f896-4432-81fb-4f3db98f3409",
              "operator": {
                "type": "boolean",
                "operation": "true",
                "singleValue": true
              },
              "leftValue": "={{ $('Set Headers').item.json.headers.some(header => header.name === \"dmarc\") }}",
              "rightValue": ""
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "2c41e06d-0dc1-474e-a13f-302fc3e4d4ad",
      "name": "无 DMARC 头",
      "type": "n8n-nodes-base.set",
      "position": [
        2480,
        3160
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": [
            {
              "id": "ae3158bf-3d91-4a61-a58c-c151362e52d7",
              "name": "dmarcvalue",
              "type": "string",
              "value": "=not found"
            }
          ]
        }
      },
      "typeVersion": 3.4
    },
    {
      "id": "81bd5082-634b-4f0e-951f-1374573fc6c0",
      "name": "提取 DMARC 头",
      "type": "n8n-nodes-base.code",
      "position": [
        2120,
        2960
      ],
      "parameters": {
        "jsCode": "// Extract the headers array from the JSON\nconst headers = $('Set Headers').item.json.headers;\n\n// Filter headers where the name is \"Received\"\nconst receivedHeaders = headers.filter(header => header.name === \"dmarc\");\n\n// Return the filtered headers\nreturn receivedHeaders;\n"
      },
      "executeOnce": false,
      "typeVersion": 2
    },
    {
      "id": "55a5745c-2c73-492c-b63c-20936043b0b6",
      "name": "设置 DMARC 值",
      "type": "n8n-nodes-base.set",
      "position": [
        2480,
        2960
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": [
            {
              "id": "179c48eb-97e5-48ab-82b8-ef4269f11366",
              "name": "spfvalue",
              "type": "string",
              "value": "={{ $json.value.toLowerCase().includes('pass') ? \"pass\" : $json.value.toLowerCase().includes('fail') ? \"fail\" : \"unknown\"}}"
            }
          ]
        }
      },
      "typeVersion": 3.4
    },
    {
      "id": "48a5b283-7aa4-4e10-b784-fcce25465fc0",
      "name": "找到原始 IP？",
      "type": "n8n-nodes-base.if",
      "position": [
        700,
        1460
      ],
      "parameters": {
        "options": {},
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "1c27e7ba-d243-4673-b1cc-608c35951168",
              "operator": {
                "type": "boolean",
                "operation": "notEmpty",
                "singleValue": true
              },
              "leftValue": "={{ $json.extractedfromip?.toBoolean() }}",
              "rightValue": ""
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "75818bdc-3ffb-42a7-a0a3-93fc413b757f",
      "name": "未找到 DKIM 签名",
      "type": "n8n-nodes-base.set",
      "position": [
        2480,
        2720
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": [
            {
              "id": "ae3158bf-3d91-4a61-a58c-c151362e52d7",
              "name": "dkimvalue",
              "type": "string",
              "value": "not found"
            }
          ]
        }
      },
      "typeVersion": 3.4
    },
    {
      "id": "17bc160b-618f-4893-80c8-4e4c2638adc3",
      "name": "确定认证值",
      "type": "n8n-nodes-base.set",
      "position": [
        2040,
        1360
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": [
            {
              "id": "cd0b3f49-fe38-4686-a1f5-bc03a145adef",
              "name": "spfvalue",
              "type": "string",
              "value": "={{ $json.value.toLowerCase().includes('spf=pass') ? \"pass\" : $json.value.toLowerCase().includes('spf=fail') ? \"fail\" : $json.value.toLowerCase().includes('spf=neutral') ? \"neutral\" : \"unknown\" }}"
            },
            {
              "id": "6aa90f4d-773e-475f-8cbc-fe5c4fe93653",
              "name": "dkimvalue",
              "type": "string",
              "value": "={{ $json.value.toLowerCase().includes('dkim=pass') ? \"pass\" : $json.value.toLowerCase().includes('dkim=fail') ? \"fail\" : $json.value.toLowerCase().includes('dkim=temperror') ? \"error\" : \"unknown\" }}"
            },
            {
              "id": "d3b7b0c1-0680-4cb9-b376-d365e5602a29",
              "name": "dmarcvalue",
              "type": "string",
              "value": "={{ $json.value.toLowerCase().includes('dmarc=pass') ? \"pass\" : $json.value.toLowerCase().includes('dmarc=fail') ? \"fail\" : \"unknown\" }}"
            }
          ]
        }
      },
      "typeVersion": 3.4
    },
    {
      "id": "8ee70aff-0907-44f5-b675-1de26660c2e3",
      "name": "未找到 SPF",
      "type": "n8n-nodes-base.set",
      "position": [
        2480,
        2320
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": [
            {
              "id": "ae3158bf-3d91-4a61-a58c-c151362e52d7",
              "name": "spfvalue",
              "type": "string",
              "value": "not found"
            }
          ]
        }
      },
      "typeVersion": 3.4
    },
    {
      "id": "a658b7d1-ec0e-40c9-a6c6-1f81e776fcfb",
      "name": "合并",
      "type": "n8n-nodes-base.merge",
      "position": [
        2840,
        1600
      ],
      "parameters": {
        "numberInputs": 3
      },
      "typeVersion": 3
    },
    {
      "id": "bb688aec-d7ae-4e5a-ac38-a8d9554966bd",
      "name": "聚合",
      "type": "n8n-nodes-base.aggregate",
      "position": [
        3000,
        1600
      ],
      "parameters": {
        "options": {},
        "aggregate": "aggregateAllItemData"
      },
      "typeVersion": 1
    },
    {
      "id": "e393c3b1-b756-44a8-ac3c-b2d9e15f4f47",
      "name": "无操作，不执行任何操作",
      "type": "n8n-nodes-base.noOp",
      "position": [
        980,
        1600
      ],
      "parameters": {},
      "typeVersion": 1
    },
    {
      "id": "d651412c-9e58-4ef6-a6eb-6556647a7223",
      "name": "格式化 Webhook 输出",
      "type": "n8n-nodes-base.set",
      "position": [
        3400,
        1460
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": []
        },
        "includeOtherFields": true
      },
      "typeVersion": 3.4
    },
    {
      "id": "03c70339-8e92-4d62-b346-7e669c83d338",
      "name": "格式化单个认证输出",
      "type": "n8n-nodes-base.set",
      "position": [
        3180,
        1600
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": [
            {
              "id": "1f466a9d-e8a1-4095-918c-89fd8e3dae57",
              "name": "spf",
              "type": "string",
              "value": "={{ $json.data[0].spfvalue }}"
            },
            {
              "id": "797b0e35-9a2e-4261-8741-a8d636e0d1ae",
              "name": "dkim",
              "type": "string",
              "value": "={{ $json.data[1].dkimvalue }}"
            },
            {
              "id": "8b6f9dda-081d-45b6-98a9-04a96642800b",
              "name": "dmarc",
              "type": "string",
              "value": "={{ $json.data[2].dmarcvalue }}"
            },
            {
              "id": "6d24a794-0d06-4f12-8bfb-cc3c71720a1b",
              "name": "initialIP",
              "type": "string",
              "value": "={{ $('Extract Original From IP').item.json.extractedfromip || 'Originating IP Not Found'}}"
            },
            {
              "id": "e9ec6f54-0ef7-451b-bbeb-8bb9291e4bcd",
              "name": "organization",
              "type": "string",
              "value": "={{ $('Query IP API').item.json.org || \"No Organization Found\" }}"
            },
            {
              "id": "719b8414-72e1-4916-855b-00abdfc8e776",
              "name": "country",
              "type": "string",
              "value": "={{ $('Query IP API').item.json.country || \"No Country Found\" }}"
            },
            {
              "id": "ab0dc08c-ba54-4e2c-b4df-9f23d36cb350",
              "name": "city",
              "type": "string",
              "value": "={{ $('Query IP API').item.json.city || \"No City Found\" }}"
            },
            {
              "id": "f8214eea-dfb6-4fe1-8e45-e0b8d3d44ee3",
              "name": "recentSpamActivity",
              "type": "string",
              "value": "={{ $('Query IP Quality Score API').item.json.fraud_score>=85 ? \"Identified spam in the last 48 hours\" : $('Query IP Quality Score API').item.json.fraud_score>=75 ? \"Identified spam in the last month\" : \"Not associated with recent spam\" }}"
            },
            {
              "id": "fe3488b2-ad00-45ad-b947-ca2dc4242363",
              "name": "ipSenderReputation",
              "type": "string",
              "value": "={{ $('Query IP Quality Score API').item.json.fraud_score>=85 ? \"Bad\" : $('Query IP Quality Score API').item.json.fraud_score>=75 ? \"Poor\" : $('Gmail - Query IP Quality Score API').item.json.fraud_score>=50 ? \"Suspicious\" : $('Query IP Quality Score API').item.json.fraud_score>=11 ? \"OK\" : $('Query IP Quality Score API').item.json.fraud_score<11 ? \"Good\" : \"Unknown\"}}"
            }
          ]
        }
      },
      "typeVersion": 3.4
    },
    {
      "id": "762153b7-0364-498f-9dba-547d676b9d74",
      "name": "格式化组合认证输出",
      "type": "n8n-nodes-base.set",
      "position": [
        2400,
        1360
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": [
            {
              "id": "1f466a9d-e8a1-4095-918c-89fd8e3dae57",
              "name": "spf",
              "type": "string",
              "value": "={{ $json.spfvalue }}"
            },
            {
              "id": "797b0e35-9a2e-4261-8741-a8d636e0d1ae",
              "name": "dkim",
              "type": "string",
              "value": "={{ $json.dkimvalue }}"
            },
            {
              "id": "8b6f9dda-081d-45b6-98a9-04a96642800b",
              "name": "dmarc",
              "type": "string",
              "value": "={{ $json.dmarcvalue }}"
            },
            {
              "id": "6d24a794-0d06-4f12-8bfb-cc3c71720a1b",
              "name": "initialIP",
              "type": "string",
              "value": "={{ $('Extract Original From IP').item.json.extractedfromip || 'Originating IP Not Found'}}"
            },
            {
              "id": "e9ec6f54-0ef7-451b-bbeb-8bb9291e4bcd",
              "name": "organization",
              "type": "string",
              "value": "={{ $('Query IP API').item.json.org || \"No Organization Found\" }}"
            },
            {
              "id": "719b8414-72e1-4916-855b-00abdfc8e776",
              "name": "country",
              "type": "string",
              "value": "={{ $('Query IP API').item.json.country || \"No Country Found\" }}"
            },
            {
              "id": "ab0dc08c-ba54-4e2c-b4df-9f23d36cb350",
              "name": "city",
              "type": "string",
              "value": "={{ $('Query IP API').item.json.city || \"No City Found\" }}"
            },
            {
              "id": "f8214eea-dfb6-4fe1-8e45-e0b8d3d44ee3",
              "name": "recentSpamActivity",
              "type": "string",
              "value": "={{ $('Query IP Quality Score API').item.json.fraud_score>=85 ? \"Identified spam in the last 48 hours\" : $('Query IP Quality Score API').item.json.fraud_score>=75 ? \"Identified spam in the last month\" : \"Not associated with recent spam\" }}"
            },
            {
              "id": "fe3488b2-ad00-45ad-b947-ca2dc4242363",
              "name": "ipSenderReputation",
              "type": "string",
              "value": "={{ $('Query IP Quality Score API').item.json.fraud_score>=85 ? \"Bad\" : $('Query IP Quality Score API').item.json.fraud_score>=75 ? \"Poor\" : $('Query IP Quality Score API').item.json.fraud_score>=50 ? \"Suspicious\" : $('Query IP Quality Score API').item.json.fraud_score>=11 ? \"OK\" : $('Query IP Quality Score API').item.json.fraud_score<11 ? \"Good\" : \"Unknown\"}}"
            }
          ]
        }
      },
      "typeVersion": 3.4
    },
    {
      "id": "391615b6-4996-4687-a07c-3f9af1246840",
      "name": "响应 Webhook",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        3620,
        1460
      ],
      "parameters": {
        "options": {}
      },
      "typeVersion": 1.1
    },
    {
      "id": "ff28eb77-d095-440e-a95f-9f3727a3c219",
      "name": "Webhook1",
      "type": "n8n-nodes-base.webhook",
      "position": [
        -780,
        2140
      ],
      "webhookId": "da28e0c6-ebe2-43e7-92fe-dde3278746a9",
      "parameters": {
        "path": "da28e0c6-ebe2-43e7-92fe-dde3278746a8",
        "options": {},
        "httpMethod": "POST",
        "responseMode": "responseNode"
      },
      "typeVersion": 2
    },
    {
      "id": "80d4ce98-c26b-4f14-9058-6dda098f4f14",
      "name": "设置头信息",
      "type": "n8n-nodes-base.set",
      "position": [
        -100,
        1460
      ],
      "parameters": {
        "options": {},
        "includeOtherFields": true
      },
      "typeVersion": 3.4
    },
    {
      "id": "fddadcd8-ecaf-4fb3-bd38-12d6e48124be",
      "name": "聚合 Received-SPF 头",
      "type": "n8n-nodes-base.aggregate",
      "position": [
        2140,
        2140
      ],
      "parameters": {
        "options": {},
        "aggregate": "aggregateAllItemData"
      },
      "typeVersion": 1
    },
    {
      "id": "175f81f1-f5ff-4170-9496-7adae5351ff4",
      "name": "在此设置头信息",
      "type": "n8n-nodes-base.set",
      "position": [
        -360,
        1400
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": [
            {
              "id": "5bf15ec1-a009-4473-a3da-fca15a6cd29a",
              "name": "headers",
              "type": "array",
              "value": "={{ $json.internetMessageHeaders }}"
            }
          ]
        }
      },
      "typeVersion": 3.4
    },
    {
      "id": "6aa1040e-1c57-4ef3-9a06-9e25ca66247f",
      "name": "在此设置 Webhook 头信息",
      "type": "n8n-nodes-base.set",
      "position": [
        -380,
        2140
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": [
            {
              "id": "80d3bf91-ce79-44b7-b8d6-a612ef810891",
              "name": "headers",
              "type": "array",
              "value": "={{ $json.body.headers }}"
            }
          ]
        }
      },
      "typeVersion": 3.4
    },
    {
      "id": "6d177ff6-333f-40af-87ee-28f5808b90b6",
      "name": "便签",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -840,
        849.3566000559811
      ],
      "parameters": {
        "color": 7,
        "width": 635.6437587743126,
        "height": 738.7992581051316,
        "content": "![](https://uploads.n8n.io/templates/outlook.png)"
      },
      "typeVersion": 1
    },
    {
      "id": "4347e3ac-6268-4f47-9ffa-d6cfdb9db6fe",
      "name": "便签1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -840,
        1597.2834217449708
      ],
      "parameters": {
        "color": 7,
        "width": 635.6437587743126,
        "height": 722.658386273084,
        "content": "![](https://uploads.n8n.io/templates/n8n.png)"
      },
      "typeVersion": 1
    },
    {
      "id": "166afae1-13f7-4c61-b605-751e2692f272",
      "name": "便签 2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -195.35026277953466,
        1001.1991904481583
      ],
      "parameters": {
        "color": 7,
        "width": 869.3564073187465,
        "height": 626.9566677129526,
        "content": "![](https://uploads.n8n.io/templates/n8n.png)"
      },
      "typeVersion": 1
    },
    {
      "id": "a676cc11-c48d-4160-a60f-5a2cce1ecc94",
      "name": "便签 3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        686.9090848322476,
        800.8639469405958
      ],
      "parameters": {
        "color": 7,
        "width": 922.1859426288208,
        "height": 965.2875565450952,
        "content": "![](https://uploads.n8n.io/templates/ipqualityscoretemplate.png)"
      },
      "typeVersion": 1
    },
    {
      "id": "999b7855-b515-45b7-a560-55882555a2c2",
      "name": "便签 4",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1622.1779104636253,
        911.7549500344078
      ],
      "parameters": {
        "color": 7,
        "width": 1016.1357697283069,
        "height": 619.3441192962306,
        "content": "![](https://uploads.n8n.io/templates/n8n.png)"
      },
      "typeVersion": 1
    },
    {
      "id": "f2fefb66-8325-4d00-932b-292b353f7b2f",
      "name": "便签 5",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        2660,
        890.7472796133279
      ],
      "parameters": {
        "color": 7,
        "width": 1285.8545784346588,
        "height": 909.4741259295762,
        "content": "![](https://uploads.n8n.io/templates/n8n.png)"
      },
      "typeVersion": 1
    },
    {
      "id": "4c2592a3-3550-428c-9622-b1e95ad28d4f",
      "name": "便签6",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1620,
        1540
      ],
      "parameters": {
        "color": 7,
        "width": 1016.1357697283069,
        "height": 1788.2607166792513,
        "content": "![](https://uploads.n8n.io/templates/n8n.png)"
      },
      "typeVersion": 1
    }
  ],
  "pinData": {},
  "connections": {
    "Merge": {
      "main": [
        [
          {
            "node": "Aggregate",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Webhook1": {
      "main": [
        [
          {
            "node": "Set Webhook Headers Here",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Aggregate": {
      "main": [
        [
          {
            "node": "Format Individual Auth Outputs",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Set Headers": {
      "main": [
        [
          {
            "node": "Extract Received Headers",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "No SPF Found": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query IP API": {
      "main": [
        [
          {
            "node": "Authentication-Results Header?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "DMARC Header?": {
      "main": [
        [
          {
            "node": "Extract DMARC Header",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "No DMARC Header",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Set SPF Value": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "No DMARC Header": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 2
          }
        ]
      ]
    },
    "Set DMARC Value": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 2
          }
        ]
      ]
    },
    "Set Headers Here": {
      "main": [
        [
          {
            "node": "Set Headers",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Original IP Found?": {
      "main": [
        [
          {
            "node": "Query IP Quality Score API",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "No Operation, do nothing",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "DKIM Signature Found": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Extract DMARC Header": {
      "main": [
        [
          {
            "node": "Set DMARC Value",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Received-SPF Header?": {
      "main": [
        [
          {
            "node": "Extract Received-SPF Header",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "No SPF Found",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Trigger on New Email": {
      "main": [
        [
          {
            "node": "Retrieve Headers of Email",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Determine Auth Values": {
      "main": [
        [
          {
            "node": "Format Combined Auth Output",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Format Webhook Output": {
      "main": [
        [
          {
            "node": "Respond to Webhook",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "DKIM-Signature Header?": {
      "main": [
        [
          {
            "node": "DKIM Signature Found",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "No DKIM Signature Found",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "No DKIM Signature Found": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Extract Original From IP": {
      "main": [
        [
          {
            "node": "Original IP Found?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Extract Received Headers": {
      "main": [
        [
          {
            "node": "Remove Extra Received Headers",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "No Operation, do nothing": {
      "main": [
        [
          {
            "node": "Authentication-Results Header?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Set Webhook Headers Here": {
      "main": [
        [
          {
            "node": "Set Headers",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Retrieve Headers of Email": {
      "main": [
        [
          {
            "node": "Set Headers Here",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query IP Quality Score API": {
      "main": [
        [
          {
            "node": "Query IP API",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Extract Received-SPF Header": {
      "main": [
        [
          {
            "node": "Aggregate Received-SPF Headers",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Format Combined Auth Output": {
      "main": [
        [
          {
            "node": "Format Webhook Output",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Remove Extra Received Headers": {
      "main": [
        [
          {
            "node": "Extract Original From IP",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Aggregate Received-SPF Headers": {
      "main": [
        [
          {
            "node": "Set SPF Value",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Authentication-Results Header?": {
      "main": [
        [
          {
            "node": "Extract Authentication-Results Header",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Received-SPF Header?",
            "type": "main",
            "index": 0
          },
          {
            "node": "DKIM-Signature Header?",
            "type": "main",
            "index": 0
          },
          {
            "node": "DMARC Header?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Format Individual Auth Outputs": {
      "main": [
        [
          {
            "node": "Format Webhook Output",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Extract Authentication-Results Header": {
      "main": [
        [
          {
            "node": "Determine Auth Values",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
常见问题

如何使用这个工作流？

复制上方的 JSON 配置代码，在您的 n8n 实例中创建新工作流并选择「从 JSON 导入」，粘贴配置后根据需要修改凭证设置即可。

这个工作流适合什么场景？

高级 - 安全运维

需要付费吗？

本工作流完全免费，您可以直接导入使用。但请注意，工作流中使用的第三方服务（如 OpenAI API）可能需要您自行付费。

相关工作流推荐

分析Gmail邮件头以检测IP信誉和欺骗
分析Gmail邮件头以检测IP信誉和欺骗
If
Set
Code
+9
40 节点Angel Menendez
安全运维
Venafi Cloud Slack 证书机器人
Venafi Cloud Slack 证书机器人
If
Set
Merge
+10
38 节点Angel Menendez
人工智能
在可视化参考库中探索n8n节点
在可视化参考库中探索n8n节点
If
Ftp
Set
+93
113 节点I versus AI
其他
灵活新闻聚合器 - 多源集成、AI分析和可设置频道
多源新闻策展系统，集成Mistral AI分析、摘要和自定义频道
If
Set
Xml
+32
120 节点Hybroht
内容创作
LinkedIn自动消息路由与响应器（含请求检测）
LinkedIn自动消息路由与响应器，具备请求检测功能
If
Set
Slack
+12
52 节点Angel Menendez
客户支持
通过 Slack 机器人上传图片到 S3 存储桶
通过 Slack 机器人上传图片到 S3 存储桶
If
S3
Set
+10
29 节点Angel Menendez
开发运维
工作流信息
难度等级
高级
节点数量41
分类1
节点类型12
难度说明

适合高级用户，包含 16+ 个节点的复杂工作流

作者
Angel Menendez

Angel Menendez

@djangelic

Angel Menendez is a Staff Developer Advocate at n8n.io, specializing in low-code tools for cybersecurity workflows. From Puerto Rico, Angel's tech journey began by helping his father translate technical books. He later started a web development business and transitioned from a career as a flight attendant to cybersecurity engineering. His workflows have saved companies significant time. Outside work, Angel enjoys time with his two sons, riding electric bikes, reading, and exploring new places.

外部链接
在 n8n.io 查看 →

分享此工作流