Flag emails that link to unfamiliar websites
Posts to Slack when new mail links to a site outside your expected list, with how recently that site was registered and who runs it.
Apps it connects
Authenticate each one once and the workflow is ready to run.
What it does
Each integration step this workflow runs, in order, what it is for, and the conditions and loops that decide when it runs.
- 1GmailNew email triggerWakes the workflow when new mail arrives in Gmail, so the messages your search matches can be read for links.
- 2GmailList emailsFetches the messages your search matches that do not yet carry the 'Links checked' label, with sender, subject and text.
For each
messageFor each
linkUrlIf a condition is met
- 3IPWHOIS.ioGet ip networkLooks up who runs a bare numeric address a link points at: the provider, the autonomous system and the country.
Otherwise
- 4RDAPLookup domainLooks up each unexpected host name in the public registry for its registration date, age in days and registrar.
- 3
If
hostLinesis not empty- 5SlackSend messagePosts one note per message listing each unexpected host, its flags and registry facts, with any web address removed.
- 5
- 6GmailAdd label to messageApplies the 'Links checked' label after the message is handled, so the search never picks it up again.
How it works
What happens on each run, in plain English.
Whenever new mail arrives, the messages your Gmail search matches are read and one Slack note per message lists the hosts their links point to. Hosts on your list of expected domains, your own and your suppliers', are left out, so what reaches Slack is mail linking somewhere you did not expect.
For each host the note gives what the public registry holds: when the name was registered, how many days ago, and the registrar, or for a bare numeric address, who runs it and in which country. It also flags a link over plain http, a name in punycode, and a link on the sender's own domain. It reports and does not conclude: nothing says whether a link is worth opening, and no address is ever visited. Only the host part of a link is used, and a report that would repeat a full web address is withheld. Each message is labelled once read, so nothing is reported twice.
You need a Slack channel, a Gmail search naming the mail to read, and a list of the domains you already expect.
You may also be interested in
Watch your websites for downtimeChecks every site listed in a spreadsheet on a schedule and alerts you in Slack or by email when one goes down or recovers.
Turn reported suspicious mail into Jira ticketsOpens a Jira ticket for each message your people report, and adds later reports of the same sender to the ticket already open.
Record where incoming emails really came fromFor the emails your Gmail search picks out, logs whether each passed the sender checks and which servers it really came through.
Check your websites' security settings every weekEach Monday, checks the sites you list for the browser protections they should switch on, and emails what is missing and how to fix it.Start from a workflow that already works.
Add "Flag emails that link to unfamiliar websites" to your workspace, connect its apps, and make it yours.
Free plan, no credit card