Investigate scam URLs with URLScan.io, Telegram, Gmail, and Data Tables

by Harvey Kubath ✓ · 78 views · created 2026-07-15 · SecOps

What this workflow does

This workflow has 20 nodes and runs when someone submits an n8n form (“Scam Site Investigator”). Along the way it connects Telegram and Gmail. It also calls urlscan.io over HTTP.

How it runs

Trigger: When someone submits an n8n form (“Scam Site Investigator”).

1. Parse Domain from URL (Code): runs custom JavaScript code
2. Fetch RDAP Domain Info (HTTP Request): calls an HTTP API
3. Fetch Certificate Transparency Info (HTTP Request): calls an HTTP API
4. Fetch DNS A Record (HTTP Request): calls an HTTP API
5. Submit for URLScan.io Analysis (HTTP Request): calls urlscan.io (POST)
6. Fetch HTML of Scam Page (HTTP Request): calls an HTTP API
7. Merge: merges the data from its input branches
8. Parse Resolved IP (Code): runs custom JavaScript code
9. Wait: waits 15 seconds
10. Parse HTML Fingerprints (Code): runs custom JavaScript code

…plus 9 more steps. See the full node list below.

Services it uses

TelegramGmail

HTTP calls to: urlscan.io

Before you upgrade to n8n 3.0

Nodes used (8)

• n8n Form Triggern8n-nodes-base.formTrigger
• Coden8n-nodes-base.code
• HTTP Requestn8n-nodes-base.httpRequest
• Mergen8n-nodes-base.merge
• Waitn8n-nodes-base.wait
• Data tablen8n-nodes-base.dataTable
• Telegramn8n-nodes-base.telegram
• Gmailn8n-nodes-base.gmail

From the author

Quick overview This workflow accepts a suspected scam URL via an n8n form, enriches it with RDAP, certificate transparency, DNS/IP hosting data, urlscan.io results, and HTML fingerprints, then correlates findings against a Data Table case log, posts a report…

View the original on n8n.io → Check your own copy