Check suspicious links via Telegram with GPT-4 analysis of VirusTotal & urlscan.io results
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This AI workflow has 11 nodes and runs on Telegram events (message). Along the way it connects Telegram, Google Sheets and OpenAI Chat Model. It also calls virustotal.com over HTTP.
How it runs
Trigger: On Telegram events (message).
- VirusTotal HTTP Request (HTTP Request): calls virustotal.com (POST)
- urlscan Perform Scan (urlscan.io): uses urlscan.io
- Merge: merges the data from its input branches
- Prepare Summary Data (Code): runs custom JavaScript code
- Malicious URL Summary Agent (AI Agent): runs an AI agent, with model: OpenAI Model; memory: Malicious URL Memory
- Limit: keeps the first few items
- Send a text message (Telegram): uses Telegram
- URL Logging (Google Sheets): append or update
Services it uses
HTTP calls to: virustotal.com
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (11)
- HTTP Request
n8n-nodes-base.httpRequest - Telegram
n8n-nodes-base.telegram - Telegram Trigger
n8n-nodes-base.telegramTrigger - Google Sheets
n8n-nodes-base.googleSheets - AI Agent
@n8n/n8n-nodes-langchain.agent - OpenAI Chat Model
@n8n/n8n-nodes-langchain.lmChatOpenAi - Simple Memory
@n8n/n8n-nodes-langchain.memoryBufferWindow - Limit
n8n-nodes-base.limit - urlscan.io
n8n-nodes-base.urlScanIo - Code
n8n-nodes-base.code - Merge
n8n-nodes-base.merge
From the author
Workflow Purpose The workflow is designed to scan submitted URLs using urlscan.io and VirusTotal, combine the results into a single structured summary, and send the report via Telegram. I built this workflow for people who primarily work from their phones and…