csirtg spam automator workflow

gistfile1.txt

# https://discussions.apple.com/thread/5675123
property theAddress : "phish@...."
property theReportSubject : "SPAM report (message attached)"
--
using terms from application "Mail"
	on perform mail action with messages theMsgs for rule theRule
		repeat with eachMsg in theMsgs
			tell application "Mail"
				try
					set theSubject to subject of eachMsg
				on error
					set theSubject to "(no subject)"
				end try
				if theSubject = "" then set theSubject to "(no subject)"
				set theSource to source of eachMsg
			end tell
			
			set theSubject to encode_text(theSubject, true, true)
			
			set theTempFileName to "/tmp/" & theSubject & ".eml"
			
			set theTempFile to open for access POSIX file theTempFileName with write permission
			set eof of theTempFile to 0
			write theSource to theTempFile starting at eof
			close access theTempFile
			tell application "Mail"
				set theNewMsg to make new outgoing message with properties {subject:theReportSubject, visible:true, content:""}
				tell theNewMsg
					make new to recipient at end of to recipients with properties {address:theAddress}
					make new attachment at after the last paragraph with properties {file name:theTempFileName}
					delay 1
					send
				end tell
			end tell
			try
				do shell script "rm " & theTempFileName
			end try
			tell application "Mail"
				set theMailbox to mailbox "spam"
				move eachMsg to theMailbox
			end tell
			delay 0
		end repeat
		set theNote to "Done processing " & length of theMsgs & " messages."
		display notification theNote with title "Mail - SPAM Workflow"
		delay 0
	end perform mail action with messages
	
	on run
		tell application "Mail" to set theMsgs to (get selection)
		perform mail action with messages theMsgs for rule {}
	end run
end using terms from
--
on encode_text(this_text, encode_URL_A, encode_URL_B)
	set the standard_characters to "abcdefghijklmnopqrstuvwxyz0123456789"
	set the URL_A_chars to "$+!'/?;&@=#%<>{}[]\"~`^\\|*"
	set the URL_B_chars to ".-_:"
	set the acceptable_characters to the standard_characters
	if encode_URL_A is false then set the acceptable_characters to the acceptable_characters & the URL_A_chars
	if encode_URL_B is false then set the acceptable_characters to the acceptable_characters & the URL_B_chars
	set the encoded_text to ""
	repeat with this_char in this_text
		if this_char is in the acceptable_characters then
			set the encoded_text to (the encoded_text & this_char)
		else
			set the encoded_text to (the encoded_text & encode_char(this_char)) as string
		end if
	end repeat
	return the encoded_text
end encode_text
--
on encode_char(this_char)
	set the ASCII_num to (the ASCII number this_char)
	set the hex_list to {"0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "A", "B", "C", "D", "E", "F"}
	set x to item ((ASCII_num div 16) + 1) of the hex_list
	set y to item ((ASCII_num mod 16) + 1) of the hex_list
	return ("%" & x & y) as string
end encode_char