Report spam and phishing URLs from IMAP mailboxes to Spamhaus
n8n14 modulesv1.0This workflow automates URL reporting to Spamhaus based on incoming spam/phishing sample emails. It watches one or more IMAP folders, extracts URLs from each email body, removes duplicates and common noise, and submits the remaining URLs to the Spamhaus submission API with the appropriate threat context. What it does - Monitors one or more IMAP mailboxes/folders containing abuse samples (spam/phish). - Processes each email individually in a loop. - Extracts and normalizes URLs from the email tex
At a glance
Report spam and phishing URLs from IMAP mailboxes to Spamhaus is a ready-made n8n workflow you import as a workflow JSON file — no build required. It connects UNSUPPORTED_SLUG_FORMAT. It's free to download. Follow the 5-step import below to go live in minutes.
- Platform
- n8n
- Connects
- UNSUPPORTED_SLUG_FORMAT
- Modules
- 14
- Price
- Free
- Version
- v1.0
About this workflow
This workflow automates URL reporting to Spamhaus based on incoming spam/phishing sample emails. It watches one or more IMAP folders, extracts URLs from each email body, removes duplicates and common noise, and submits the remaining URLs to the Spamhaus submission API with the appropriate threat context. What it does - Monitors one or more IMAP mailboxes/folders containing abuse samples (spam/phish). - Processes each email individually in a loop. - Extracts and normalizes URLs from the email text. - De-duplicates URLs (per run) and filters out common false positives (images, tracking pixels, privacy/imprint pages). - Submits each URL to Spamhaus via POST /portal/api/v1/submissions/add/url. - Optionally runs: - mail-specific jobs (per email) for enrichment, logging, ticketing, notifications, etc. - run-specific jobs (once per workflow execution) for summaries, metrics, cleanup, or follow-up workflows. How it works (high level) 1. IMAP triggers fetch new messages from configured folders. 2. An initial Set node attaches metadata such as: - threattype (e.g., spam or phish) - reason.url (human-readable reason for the submission) 3. SplitInBatches loops over each email. 4. A Code node extracts all URLs from the email body, normalizes them, and removes obvious noise (e.g., trailing punctuation). 5. Remove Duplicates clears dedupe history and ensures only unique URLs are processed per run. 6. URLs are split into single items, filtered, and then packaged into the Spamhaus request body. 7. HTTP Request submits each URL to Spamhaus. 8. Aggregate collects results, enabling optional per-run actions at the end. Extending with more IMAP triggers You can add as many additional IMAP triggers as needed. To do so, connect each new IMAP trigger to the same initial Set node (or duplicate that Set node per trigger) to define the correct threattype and reason.url. The downstream flow stays unchanged. Customization points - Threat classification: Adjust threattype and reason.url in the initial Set nodes. - URL extraction rules: Update the regex and normalization logic in extract all URLs. - Filtering: Extend the filter regex to exclude additional benign paths/domains. - Per-email actions: Add nodes or call a sub-workflow from add mail specific job. - Per-run actions: Add nodes after the loop to add run specific job (summaries/metrics/cleanup). Requirements - An IMAP account with access to the folders containing sample emails. - A Spamhaus API credential (configured as an HTTP Header Auth credential in n8n). - n8n credentials set up for: - IMAP - HTTP Header Auth (Spamhaus) Notes - Ensure run-specific logic is connected to the loop’s done / “No items left” output so it runs once after all emails are processed (not per email). - This workflow only extracts URLs from the email text content. If you need URL extraction from HTML parts or attachments, extend the extraction step accordingly.
How to import this n8n workflow
- 1
Download the workflow JSON file after purchase.
- 2
Open n8n → click the menu → Import from File.
- 3
Select the downloaded JSON and import.
- 4
Set up credentials for each node that requires them.
- 5
Click Execute Workflow to test, then activate.
Setup guide
Setup guide included
Purchase to unlock the full step-by-step guide
Related N8n workflows
Get Google search results (SERPs) for SEO research
Create AI-ready vector datasets from web content with Claude, Ollama & Qdrant
Get Malaysia tax ID number (TIN) for multiple business reg num (SSM) or NRIC
Automate time tracking enforcement & cleanup for Awork tasks
Host your own JWT authentication system with Data Tables and token management
Create a new contact in Vyfakturuj.cz from a Google Contact
Create YouTube videos daily from Google Sheets using MagicHour + Gemini
Perform SEO keyword research & insights with Ahrefs API and Gemini 1.5 Flash
Reviews
No reviews yet
Be the first to buy and share your experience.
Leave a review
Sign in to share your experience with this workflow.
Create a free account to purchase workflows.
- JSON blueprint — instant download
- Setup guide PDF included
- 5 downloads · valid 30 days
- Works with n8n
Need help setting this up?
Book a 3-hour live setup session with an Agility consultant.
- Configure live on Google Meet / Zoom
- Free follow-up if workflow has defects
- Platform expert assigned to you