Analyze URL phishing risk with VirusTotal, Safe Browsing, Gemini, and Slack
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This AI workflow has 17 nodes and runs when someone submits an n8n form (“URL Threat Scanner”). Along the way it connects Google Sheets, Slack and Google Gemini Chat Model. It also calls virustotal.com over HTTP.
How it runs
Trigger: When someone submits an n8n form (“URL Threat Scanner”).
- Prepare URL Data (Edit Fields (Set)): sets 3 fields: submitted_url, domain, scan_timestamp
- Post to Safe Browsing API (HTTP Request): calls an HTTP API (POST)
- Fetch IP and Location Info (HTTP Request): calls an HTTP API
- Retrieve Domain Age (HTTP Request): calls an HTTP API
- Get SSL Certificate History (HTTP Request): calls an HTTP API
- Combine crt.sh Results (Code): runs custom JavaScript code
- Submit URL to VirusTotal (HTTP Request): calls virustotal.com (POST)
- Wait: waits 1 seconds
- Get VirusTotal Report (HTTP Request): calls an HTTP API
- Aggregate Risk Scores (Code): runs custom JavaScript code
…plus 4 more steps. See the full node list below.
Services it uses
HTTP calls to: virustotal.com
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (10)
- n8n Form Trigger
n8n-nodes-base.formTrigger - Edit Fields (Set)
n8n-nodes-base.set - HTTP Request
n8n-nodes-base.httpRequest - Wait
n8n-nodes-base.wait - Google Sheets
n8n-nodes-base.googleSheets - Slack
n8n-nodes-base.slack - Code
n8n-nodes-base.code - Basic LLM Chain
@n8n/n8n-nodes-langchain.chainLlm - Google Gemini Chat Model
@n8n/n8n-nodes-langchain.lmChatGoogleGemini - Structured Output Parser
@n8n/n8n-nodes-langchain.outputParserStructured
From the author
Quick overview Youtube Video: https://youtu.be/ekCMYUeee6Y?si=fphlFmKkarUKUBKg This workflow collects a URL via an n8n form, checks it against Google Safe Browsing and VirusTotal, enriches it with RDAP, crt.sh, and IP geolocation data, then uses Google Gemini…