Monitor SSL certificates for brand-impersonating domains with crt.sh, Urlscan.io and Slack
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This workflow has 9 nodes and runs on a schedule (every hour). Along the way it connects Slack.
How it runs
Trigger: On a schedule (every hour).
- Poll crt.sh (SSL Logs) (HTTP Request): calls an HTTP API
- Split Out: splits a list into separate items
- Filter & Deduplicate (Code): runs custom JavaScript code
- Split In Batches (Loop Over Items (Split in Batches)): loops over the items in batches
- Perform a scan (urlscan.io): uses urlscan.io
- Wait: waits 30 seconds
- Get a scan (urlscan.io): get
- Alert Slack (Slack): uses Slack
Services it uses
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (8)
- Schedule Trigger
n8n-nodes-base.scheduleTrigger - HTTP Request
n8n-nodes-base.httpRequest - Code
n8n-nodes-base.code - Loop Over Items (Split in Batches)
n8n-nodes-base.splitInBatches - Wait
n8n-nodes-base.wait - Slack
n8n-nodes-base.slack - urlscan.io
n8n-nodes-base.urlScanIo - Split Out
n8n-nodes-base.splitOut
From the author
Phishing Lookout (Typosquatting) and Brand Domain Monitor This workflow monitors SSL certificate logs to find and scan new domains that might be impersonating your brand. Background In modern cybersecurity, Brand Impersonation (or "Typosquatting") is quite…