The Fine Print

from crewai import Agent, Task, Crew
from langchain_openai import ChatOpenAI
llm = ChatOpenAI(model="gpt-4-turbo", temperature=0)
header_agent = Agent(
    role='Email Header Analyst',
    goal='Analyze email headers to determine if the email is spoofed or bypasses authentication.',
    backstory='Expert in SMTP protocols, SPF, DKIM, and DMARC alignment.',
    verbose=True,
    llm=llm
)
payload_agent = Agent(
    role='Payload and URL Analyst',
    goal='Extract and evaluate URLs/attachments from the email body for malicious intent.',
    backstory='Malware analyst skilled at spotting credential harvesting domains.',
    verbose=True,
    llm=llm
)
response_agent = Agent(
    role='Takedown Response Coordinator',
    goal='Draft an automated abuse report to the hosting provider of the malicious payload.',
    backstory='Legal and compliance specialist focused on rapid infrastructure takedowns.',
    verbose=True,
    llm=llm
)
email_data = """
Headers: Return-Path: <bounce@attacker.net>, Received: from mail.attacker.net (192.0.2.100)
Authentication-Results: spf=fail (domain owner of paypal.com does not designate 192.0.2.100 as permitted sender)
Body: Dear Customer, your account is suspended. Click here to verify: http://paypal-update-security-login.net/auth
"""
header_task = Task(
    description=f'Determine if this email is spoofed based on the headers: {email_data}',
    expected_output='Spoofing analysis report including SPF/DKIM status.',
    agent=header_agent
)
payload_task = Task(
    description=f'Identify the malicious URL in the body and classify the type of attack (e.g., Credential Harvesting): {email_data}',
    expected_output='URL classification and threat type.',
    agent=payload_agent
)
takedown_task = Task(
    description='Using the header and payload analysis, draft a formal Abuse Report email to be sent to the domain registrar of the malicious URL requesting a takedown.',
    expected_output='A formal, ready-to-send abuse takedown email.',
    agent=response_agent,
    context=[header_task, payload_task]
)
phishing_swarm = Crew(
    agents=[header_agent, payload_agent, response_agent],
    tasks=[header_task, payload_task, takedown_task]
)
if __name__ == "__main__":
    print("Initiating Phishing Analysis Swarm...")
    takedown_report = phishing_swarm.kickoff()
    print("\n--- Takedown Request Draft ---\n")
    print(takedown_report)