URL and IP Threat Scanning Workflow
detail.loadingPreview
Scans provided URLs and IPs for malicious activity using VirusTotal and Greynoise, then reports findings via email and Slack.
🚀Ready to Deploy This Workflow?
About This Workflow
Overview
This n8n workflow automates the process of scanning URLs and IP addresses for potential threats. It leverages the VirusTotal API for comprehensive analysis and Greynoise to check for known malicious activity. The results are then consolidated and sent as a report to a specified email address and a Slack channel for immediate notification and review.
Key Features
- Receives a list of URLs and/or IPs via webhook.
- Determines if an input is an IP address or a URL.
- Performs DNS lookups for URLs to resolve them to IP addresses.
- Scans URLs and IPs using VirusTotal for threat intelligence.
- Checks for threat information using Greynoise.
- Merges results from both VirusTotal and Greynoise.
- Sends a detailed report to a specified email address.
- Notifies a Slack channel with a summary of the findings.
How To Use
-
Configure Webhook: Set up the "Webhook" node with your desired path and HTTP method (POST is recommended).
-
Input Data: Send a POST request to the webhook URL with a JSON body containing an array of
data(each with aurlfield) and anemailfield for the report recipient. Example:{ "data": [{"url": "1.1.1.1"}, {"url": "88.204.59.2"}, {"url": "facebook.com"}], "email": "your.email@example.com" }
-
Set up Credentials: Configure the necessary API credentials for VirusTotal and potentially Greynoise in n8n.
-
Configure Nodes: Update the
API_BASE_URLandBASE_URLenvironment variables for the VirusTotal and DNS lookup nodes respectively. -
Review Slack Channel: Ensure the "Send Report Slack" node is configured with the correct channel name (
#notificationsin the example). -
Run Workflow: Activate the workflow and send data to the webhook.
Apps Used
Workflow JSON
{
"id": "40d8763b-ec27-434e-8761-2b874cfde060",
"name": "URL and IP Threat Scanning Workflow",
"nodes": 0,
"category": "Security",
"status": "active",
"version": "1.0.0"
}Note: This is a sample preview. The full workflow JSON contains node configurations, credentials placeholders, and execution logic.
Get This Workflow
ID: 40d8763b-ec27...
About the Author
Free n8n Workflows Official
System Admin
The official repository for verified enterprise-grade workflows.
Statistics
Verification Info
Related Workflows
Discover more workflows you might like
Suspicious Login Detection
Detects and alerts users about suspicious login activity.
Community: TOTP Code Generation Guide
Learn how to set up and generate TOTP codes within n8n.
Website Security Scanner
Scan your website for security vulnerabilities and misconfigurations.
Qualys Scan Report Generator (Community)
Generates detailed scan reports from Qualys.
Email Security Scanner
Scans incoming emails for phishing attempts using ChatGPT and creates Jira tickets for suspicious findings.
Qualys Vulnerability Scan and Report Generator
Automate Qualys vulnerability scans and report generation directly from Slack.