Report spam and phishing URLs from IMAP mailboxes to Spamhaus

by Vitali ✓ · 386 views · created 2026-01-20 · SecOps

What this workflow does

This workflow has 14 nodes and runs when a new email arrives over IMAP (plus 1 other trigger). It uses only n8n's built-in nodes. It also calls submit.spamhaus.org over HTTP.

How it runs

Trigger: When a new email arrives over IMAP (plus 1 other trigger).

1. initial config spam (Edit Fields (Set)): sets 3 fields: email, threat_type, reason.url
2. initial phish config (Edit Fields (Set)): sets 3 fields: email, threat_type, reason.url
3. Loop over each email (Loop Over Items (Split in Batches)): loops over the items in batches
4. extract all URLs (Code): runs custom JavaScript code
5. de-duplicate URLs (Remove Duplicates): removes duplicate items
6. split URLs to array (Split Out): splits a list into separate items
7. Filter: keeps only the items that match a condition
8. create item for spamhaus (Edit Fields (Set)): sets 3 fields: source.object, threat_type, reason
9. Spamhaus submit url (HTTP Request): calls submit.spamhaus.org (POST)
10. Aggregate: combines items into one

HTTP calls to: submit.spamhaus.org

Before you upgrade to n8n 3.0

Nodes used (10)

• Email Trigger (IMAP)n8n-nodes-base.emailReadImap
• Edit Fields (Set)n8n-nodes-base.set
• Coden8n-nodes-base.code
• HTTP Requestn8n-nodes-base.httpRequest
• Loop Over Items (Split in Batches)n8n-nodes-base.splitInBatches
• Aggregaten8n-nodes-base.aggregate
• No Operation, do nothingn8n-nodes-base.noOp
• Remove Duplicatesn8n-nodes-base.removeDuplicates
• Split Outn8n-nodes-base.splitOut
• Filtern8n-nodes-base.filter

From the author

This workflow automates URL reporting to Spamhaus based on incoming spam/phishing sample emails. It watches one or more IMAP folders, extracts URLs from each email body, removes duplicates and common noise, and submits the remaining URLs to the Spamhaus…

View the original on n8n.io → Check your own copy