Automated Steam Phishing Detection and Reporting
detail.loadingPreview
This workflow automatically detects and reports potential Steam phishing websites. It leverages DNS checks to identify suspicious domains and sends alerts to Cloudflare and Valve security teams.
About This Workflow
The 'Steam + CF Report' n8n workflow is a powerful tool for proactively identifying and reporting potential Steam phishing attempts. Upon receiving a domain name via a webhook, the workflow first validates the input to ensure it's a legitimate domain format. It then checks if the domain has active nameservers, indicating it's an active website. Crucially, it queries DNS records to determine if the domain is using Cloudflare. If it is, an alert is sent to Cloudflare's security team. If not, or if other checks fail, a report is sent to Valve's security team. This automated process significantly enhances the speed and efficiency of combating online threats.
Key Features
- Automated Phishing Detection: Proactively identifies potential phishing websites targeting Steam users.
- Intelligent DNS Validation: Uses
digcommands to verify domain existence and identify DNS records. - Cloudflare Integration: Specifically checks for domains managed by Cloudflare to route notifications appropriately.
- Automated Reporting: Sends direct email alerts to Cloudflare and Valve security teams upon detection.
- Robust Error Handling: Includes retry mechanisms for network operations to ensure workflow reliability.
How To Use
- Set up the Webhook: Configure the 'Webhook' node with a unique path (e.g., 'steam') and enable Basic Authentication for secure incoming requests. Ensure your
credentialsare set up for HTTP Basic Auth. - Input Validation: The 'IF1' node checks if the received domain name adheres to a standard format. If not, the workflow stops here.
- Install Dependencies: The 'Add bind-tools' node ensures the
digcommand is available. This command is essential for DNS lookups. - Check for Nameservers: The 'dig check if domain is valid' node queries the domain's nameservers. The 'If it has nameservers' node then checks if the domain is actively registered and configured.
- Cloudflare Check: If nameservers are found, the 'dig check CF' node checks if the domain is using Cloudflare. The subsequent 'IF' node determines the next step based on this.
- Notification Routing: If the domain is identified as using Cloudflare, the 'Mail CloudFlare' node sends an alert to
security@cloudflare.com. Otherwise, or if the Cloudflare check fails, the 'Mail Steam' node sends an alert tosecurity@valvesoftware.com. - Configure Emails: Update the
yourCCemail,yourFROMemailin the Mailgun nodes with your actual email addresses and ensure your Mailgun credentials are correctly configured.
Apps Used
Workflow JSON
{
"id": "a94db815-767e-4124-960c-e7343bc1da7b",
"name": "Automated Steam Phishing Detection and Reporting",
"nodes": 29,
"category": "DevOps",
"status": "active",
"version": "1.0.0"
}Note: This is a sample preview. The full workflow JSON contains node configurations, credentials placeholders, and execution logic.
Get This Workflow
ID: a94db815-767e...
About the Author
Crypto_Watcher
Web3 Developer
Automated trading bots and blockchain monitoring workflows.
Statistics
Related Workflows
Discover more workflows you might like
Automated PR Merged QA Notifications
Streamline your QA process with this automated workflow that notifies your team upon successful Pull Request merges. Leverage AI and vector stores to enrich notifications and ensure seamless integration into your development pipeline.
Automate Qualys Report Generation and Retrieval
Streamline your Qualys security reporting by automating the generation and retrieval of reports. This workflow ensures timely access to crucial security data without manual intervention.
Visualize Your n8n Workflows: Interactive Dashboard with Mermaid.js
Gain unparalleled visibility into your n8n automation landscape. This workflow transforms your n8n instance into a dynamic, interactive dashboard, leveraging Mermaid.js to visualize all your workflows in one accessible place.