Check phishing URL reputation with VirusTotal and log to Google Sheets
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This workflow has 18 nodes and runs when an HTTP POST request hits its webhook URL. Along the way it connects Google Sheets. It also calls virustotal.com over HTTP.
How it runs
Trigger: When an HTTP POST request hits its webhook URL.
- Normalize Input URL (Code): runs custom JavaScript code
- If: checks a condition and branches into true / false
- VirusTotal - Submit URL for Scan (HTTP Request): calls virustotal.com (POST)
- Respond - Invalid URL error (Respond to Webhook): sends the response back to the webhook caller
- If: checks a condition and branches into true / false
- Respond - VT Service Error (Respond to Webhook): sends the response back to the webhook caller
- Wait: waits 10 seconds
- VirusTotal - Get Scan Analysis (HTTP Request): calls an HTTP API
- If: checks a condition and branches into true / false
- If: checks a condition and branches into true / false
…plus 7 more steps. See the full node list below.
Services it uses
HTTP calls to: virustotal.com
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (7)
- Webhook
n8n-nodes-base.webhook - Code
n8n-nodes-base.code - If
n8n-nodes-base.if - Respond to Webhook
n8n-nodes-base.respondToWebhook - HTTP Request
n8n-nodes-base.httpRequest - Wait
n8n-nodes-base.wait - Google Sheets
n8n-nodes-base.googleSheets
From the author
🐟 Phishing URL Reputation Checker with VirusTotal This n8n template helps you automatically analyze URLs for phishing and malicious activity using VirusTotal’s multi-engine threat intelligence platform. It validates incoming URLs, submits them for scanning,…