Analyze domain threats via Telegram with VirusTotal, AbuseCH, and Gemini AI
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This AI workflow has 11 nodes and runs on Telegram events (message). Along the way it connects Telegram and Google Gemini. It also calls threatfox-api.abuse.ch and urlhaus-api.abuse.ch over HTTP.
How it runs
Trigger: On Telegram events (message).
- Abuse.CH_ThreatFox request (HTTP Request): calls threatfox-api.abuse.ch (POST)
- Abuse.CH_URLHaus request (HTTP Request): calls urlhaus-api.abuse.ch (POST)
- VirusTotal HTTP Request (HTTP Request): calls an HTTP API (GET)
- Edit Field - ThreatFox (Edit Fields (Set)): sets 2 fields: sourceNode, DataSummary
- Edit Field - URLHaus (Edit Fields (Set)): sets 2 fields: sourceNode, DataSummary
- Edit Field - VirusTotal (Edit Fields (Set)): sets 2 fields: sourceNode, DataSummary
- Merge: merges the data from its input branches
- Aggregate: combines items into one
- Message a model (Google Gemini): uses Google Gemini
- Send a text message (Telegram): uses Telegram
Services it uses
HTTP calls to: threatfox-api.abuse.ch, urlhaus-api.abuse.ch
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (7)
- HTTP Request
n8n-nodes-base.httpRequest - Telegram Trigger
n8n-nodes-base.telegramTrigger - Telegram
n8n-nodes-base.telegram - Aggregate
n8n-nodes-base.aggregate - Google Gemini
@n8n/n8n-nodes-langchain.googleGemini - Merge
n8n-nodes-base.merge - Edit Fields (Set)
n8n-nodes-base.set
From the author
Domain AI Analysis via Telegram, AbuseCH and VirusTotal Workflow Description This workflow allows Telegram users to submit a domain for quick threat intelligence analysis. It queries VirusTotal, AbuseCH URLHaus, and AbuseCH ThreatFox, then uses Gemini AI to…