Vitali This workflow corresponds to n8n.io template #12846 — we link there as the canonical source.
This workflow follows the Emailreadimap → HTTP Request recipe pattern — see all workflows that pair these two integrations.
The workflow JSON
Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →
{
"nodes": [
{
"id": "9c98c067-3864-4883-87b7-45cc42685945",
"name": "Phishing Trigger",
"type": "n8n-nodes-base.emailReadImap",
"disabled": true,
"position": [
-672,
200
],
"parameters": {
"format": "resolved",
"mailbox": "spamhaus/phishing",
"options": {
"customEmailConfig": "[\"SEEN\"]",
"trackLastMessageId": true
}
},
"credentials": {
"imap": {
"name": "<your credential>"
}
},
"typeVersion": 2.1
},
{
"id": "55d791f1-63d8-4e3c-abb9-654cf858d6bc",
"name": "Spam Trigger",
"type": "n8n-nodes-base.emailReadImap",
"position": [
-672,
8
],
"parameters": {
"format": "resolved",
"mailbox": "spamhaus/spam",
"options": {
"customEmailConfig": "[\"SEEN\"]",
"trackLastMessageId": true
}
},
"credentials": {
"imap": {
"name": "<your credential>"
}
},
"typeVersion": 2.1
},
{
"id": "ae2fdea3-fb44-427a-a1b5-0cbd619f9dbf",
"name": "initial config spam",
"type": "n8n-nodes-base.set",
"position": [
-448,
8
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "4f8fff9f-a82b-48fb-b4ba-f11cf0d57fe0",
"name": "email",
"type": "object",
"value": "={{ $json }}"
},
{
"id": "c8295c39-6f23-40b7-af80-04f7841d495f",
"name": "threat_type",
"type": "string",
"value": "spam"
},
{
"id": "3626441a-cc38-4efc-a703-31a37a70a964",
"name": "reason.url",
"type": "string",
"value": "url used in spam email"
}
]
}
},
"typeVersion": 3.4
},
{
"id": "1acc162e-d4b2-4df4-a3f4-d0ee068c8dd5",
"name": "extract all URLs",
"type": "n8n-nodes-base.code",
"position": [
0,
128
],
"parameters": {
"jsCode": "function normalizeUrl(u) {\n u = u.trim();\n\n u = u.split(/[\\]\\)\\>\\\"\\'\\s]/)[0];\n\n u = u.replace(/[.,;:]+$/g, \"\");\n\n if (!/^https?:\\/\\//i.test(u) && /^[a-z0-9.-]+\\.[a-z]{2,}(\\/|$)/i.test(u)) {\n u = \"http://\" + u;\n }\n return u;\n}\n\nconst re = /https?:\\/\\/[^\\s\"'<>]+|(?:\\b[a-z0-9.-]+\\.[a-z]{2,}(?:\\/[^\\s\"'<>]*)?)/gi;\n\nconst items = $input.all();\n\nconst allUrls = [];\n\nfor (const item of items) {\n const email = item.json.email || {};\n const candidates = [email.text]\n .filter(Boolean)\n .join(\"\\n\\n\");\n\n const found = (candidates.match(re) || [])\n .map(normalizeUrl)\n .filter(Boolean)\n .filter(u => !/\\.(png|jpe?g|gif|webp|svg)(\\?|$)/i.test(u))\n .filter(u => !/\\/pixel\\/tracking\\//i.test(u));\n\n allUrls.push(...found);\n}\n\nconst urls = [...new Set(allUrls)];\n\nreturn [\n {\n json: { urls }\n }\n];"
},
"executeOnce": false,
"typeVersion": 2
},
{
"id": "414a22ba-0b8b-407b-9580-83a075ab095e",
"name": "create item for spamhaus",
"type": "n8n-nodes-base.set",
"position": [
896,
128
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "b7fc46da-2fce-47ba-a5d8-ee6d59c7a51d",
"name": "source.object",
"type": "string",
"value": "={{ $json.urls }}"
},
{
"id": "55d30c8f-46b2-4e9c-8c15-d7ec20756190",
"name": "threat_type",
"type": "string",
"value": "={{ $('Loop over each email').item.json.threat_type }}"
},
{
"id": "1c2e40a5-4699-491e-a0c0-d55c3c852097",
"name": "reason",
"type": "string",
"value": "={{ $('Loop over each email').item.json.reason.url }}"
}
]
}
},
"typeVersion": 3.4
},
{
"id": "f807f2a9-0ad5-42e8-be72-4303675fdb45",
"name": "Spamhaus submit url",
"type": "n8n-nodes-base.httpRequest",
"position": [
1120,
128
],
"parameters": {
"url": "https://submit.spamhaus.org/portal/api/v1/submissions/add/url",
"method": "POST",
"options": {},
"jsonBody": "={{ $json.toJsonString() }}",
"sendBody": true,
"specifyBody": "json",
"authentication": "genericCredentialType",
"genericAuthType": "httpHeaderAuth"
},
"credentials": {
"httpHeaderAuth": {
"name": "<your credential>"
}
},
"typeVersion": 4.3
},
{
"id": "93a56dc1-6d80-4dc0-bb27-5c8cc9335c5c",
"name": "Loop over each email",
"type": "n8n-nodes-base.splitInBatches",
"position": [
-224,
128
],
"parameters": {
"options": {}
},
"typeVersion": 3
},
{
"id": "a1e6a6b4-256f-4fd2-9d9c-f727b69ffd8a",
"name": "initial phish config",
"type": "n8n-nodes-base.set",
"disabled": true,
"position": [
-448,
200
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "f081a452-58d6-42b1-b8ec-5d769222e366",
"name": "email",
"type": "object",
"value": "={{ $json }}"
},
{
"id": "920edd81-92fc-4a13-91f9-1ec991dd504e",
"name": "threat_type",
"type": "string",
"value": "phish"
},
{
"id": "95fb5902-fb79-4adc-b869-2d3e5d667142",
"name": "reason.url",
"type": "string",
"value": "url used in phish email"
}
]
}
},
"typeVersion": 3.4
},
{
"id": "69de29e4-4376-4a1e-948c-023be95f660e",
"name": "aggregate all into a single list",
"type": "n8n-nodes-base.aggregate",
"notes": "This is solely to count how many URLs were reported.",
"position": [
1344,
200
],
"parameters": {
"options": {},
"aggregate": "aggregateAllItemData"
},
"notesInFlow": true,
"typeVersion": 1
},
{
"id": "7eb3f398-772f-4c83-b789-2f4fc69e2ca4",
"name": "add run specific job",
"type": "n8n-nodes-base.noOp",
"position": [
0,
-64
],
"parameters": {},
"typeVersion": 1
},
{
"id": "e5c8271d-6aa7-4051-a974-1d16c3794f99",
"name": "Sticky Note1",
"type": "n8n-nodes-base.stickyNote",
"position": [
-720,
464
],
"parameters": {
"width": 832,
"height": 624,
"content": "# Report URLs to Spamhaus\nThis workflow is designed to automate the process of reporting malicious URLs to Spamhaus based on real spam or phishing emails that you receive in your mailbox.\n\nIt monitors one or more IMAP mailboxes or folders. Each email is treated as a sample and processed individually. Early in the workflow, a small configuration step assigns context such as the threat type (for example spam or phishing) and a human-readable reason that will later be sent to Spamhaus together with the URL.\n\n## How it works\nEach email is handled in a loop. The workflow extracts all URLs from the email body, normalizes them, and removes obvious noise such as image links, tracking pixels, and common non-malicious pages like privacy or imprint URLs. URLs are de-duplicated per run to avoid submitting the same URL multiple times.\n\nEvery remaining URL is then submitted to the Spamhaus submission API with the appropriate context. After all emails have been processed, the workflow can optionally run a final run-level step to handle aggregated tasks such as reporting, metrics, cleanup, or triggering follow-up workflows.\n\n## Setup steps\n- Configure one or more IMAP credentials and point the IMAP trigger(s) to the folders containing spam or phishing samples.\n- Adjust the initial configuration nodes to set the correct threat type and reporting reason. Repeat per IMAP trigger.\n- Add your Spamhaus API credentials to the HTTP Request node.\n- Optionally extend the workflow with per-email logic inside the loop or run-level logic after the loop.\n\n\nThe workflow is intentionally modular so additional mailboxes, filters, or post-processing steps can be added without changing the core logic."
},
"typeVersion": 1
},
{
"id": "00ea0b3e-751d-4363-b0ca-fc45eef373b4",
"name": "Sticky Note",
"type": "n8n-nodes-base.stickyNote",
"position": [
-720,
-64
],
"parameters": {
"color": 7,
"width": 432,
"height": 448,
"content": "# Triggers"
},
"typeVersion": 1
},
{
"id": "56e9bb71-35c7-4032-8bd6-047194a096c0",
"name": "Sticky Note2",
"type": "n8n-nodes-base.stickyNote",
"position": [
-272,
64
],
"parameters": {
"color": 7,
"width": 1760,
"height": 320,
"content": "# Process each email individually"
},
"typeVersion": 1
},
{
"id": "fd34571d-f8f2-40c4-90a1-b697602d8da7",
"name": "add email specific job",
"type": "n8n-nodes-base.noOp",
"position": [
1568,
200
],
"parameters": {},
"typeVersion": 1
},
{
"id": "95ef1592-1db0-492d-9888-75bd3e494624",
"name": "de-duplicate URLs",
"type": "n8n-nodes-base.removeDuplicates",
"position": [
224,
128
],
"parameters": {
"options": {},
"operation": "clearDeduplicationHistory"
},
"typeVersion": 2
},
{
"id": "48354390-e58c-47ea-a6eb-71dc0eeb1540",
"name": "split URLs to array",
"type": "n8n-nodes-base.splitOut",
"position": [
448,
128
],
"parameters": {
"options": {},
"fieldToSplitOut": "urls"
},
"typeVersion": 1
},
{
"id": "b0595adf-1dda-47a2-a9da-de2dea2fc60d",
"name": "filter out URLs that match regexes",
"type": "n8n-nodes-base.filter",
"position": [
672,
128
],
"parameters": {
"options": {},
"conditions": {
"options": {
"version": 3,
"leftValue": "",
"caseSensitive": true,
"typeValidation": "strict"
},
"combinator": "and",
"conditions": [
{
"id": "ca9ae718-4f53-44b5-97b0-919284e22fde",
"operator": {
"type": "string",
"operation": "notRegex"
},
"leftValue": "={{ $json.urls }}",
"rightValue": "/(privacy|imprint|impressum)/i"
}
]
}
},
"typeVersion": 2.3
}
],
"connections": {
"Spam Trigger": {
"main": [
[
{
"node": "initial config spam",
"type": "main",
"index": 0
}
]
]
},
"Phishing Trigger": {
"main": [
[
{
"node": "initial phish config",
"type": "main",
"index": 0
}
]
]
},
"extract all URLs": {
"main": [
[
{
"node": "de-duplicate URLs",
"type": "main",
"index": 0
}
]
]
},
"de-duplicate URLs": {
"main": [
[
{
"node": "split URLs to array",
"type": "main",
"index": 0
}
]
]
},
"Spamhaus submit url": {
"main": [
[
{
"node": "aggregate all into a single list",
"type": "main",
"index": 0
}
]
]
},
"initial config spam": {
"main": [
[
{
"node": "Loop over each email",
"type": "main",
"index": 0
}
]
]
},
"split URLs to array": {
"main": [
[
{
"node": "filter out URLs that match regexes",
"type": "main",
"index": 0
}
]
]
},
"Loop over each email": {
"main": [
[
{
"node": "add run specific job",
"type": "main",
"index": 0
}
],
[
{
"node": "extract all URLs",
"type": "main",
"index": 0
}
]
]
},
"initial phish config": {
"main": [
[
{
"node": "Loop over each email",
"type": "main",
"index": 0
}
]
]
},
"add email specific job": {
"main": [
[]
]
},
"create item for spamhaus": {
"main": [
[
{
"node": "Spamhaus submit url",
"type": "main",
"index": 0
}
]
]
},
"aggregate all into a single list": {
"main": [
[
{
"node": "Loop over each email",
"type": "main",
"index": 0
},
{
"node": "add email specific job",
"type": "main",
"index": 0
}
]
]
},
"filter out URLs that match regexes": {
"main": [
[
{
"node": "create item for spamhaus",
"type": "main",
"index": 0
}
]
]
}
}
}
Credentials you'll need
Each integration node will prompt for credentials when you import. We strip credential IDs before publishing — you'll add your own.
httpHeaderAuthimap
Pro
For the full experience including quality scoring and batch install features for each workflow upgrade to Pro
About this workflow
This workflow automates URL reporting to Spamhaus based on incoming spam/phishing sample emails. It watches one or more IMAP folders, extracts URLs from each email body, removes duplicates and common noise, and submits the remaining URLs to the Spamhaus submission API with the…
Source: https://n8n.io/workflows/12846/ — original creator credit. Request a take-down →
Related workflows
Workflows that share integrations, category, or trigger type with this one. All free to copy and import.
This n8n workflow helps users easily discover nearby residential construction projects by automatically scraping and analyzing property listings from 99acres and other real estate platforms. Users can
Email Read Imap, HTTP Request, Email Send
Email Order ID Extractor (Body + Attachments + OCR). Uses httpRequest, emailReadImap. Manual trigger; 11 nodes.
HTTP Request, Email Read Imap
This n8n workflow automates subdomain creation and deletion on GoDaddy using their API, triggered via email requests. This empowers developers to manage subdomains directly without involving DevOps fo
HTTP Request, Email Read Imap, Email Send
Listen On New Emails On A Imap Mailbox. Uses emailReadImap, moveBinaryData, xml, httpRequest. Manual trigger; 5 nodes.
Email Read Imap, Move Binary Data, XML +1
ImapEmail, XmlToJson, POST-HTTP-Request. Uses emailReadImap, moveBinaryData, xml, httpRequest. Manual trigger; 5 nodes.
Email Read Imap, Move Binary Data, XML +1