Workflow: Steam + CF Report
Integrations: executeCommand, if, mailgun, webhook

{"name": "Steam + CF Report", "nodes": [{"name": "Webhook", "type": "n8n-nodes-base.webhook", "position": [110, 200], "parameters": {"path": "steam", "responseData": "allEntries", "responseMode": "lastNode", "authentication": "basicAuth"}, "credentials": {"httpBasicAuth": "credentials"}, "retryOnFail": false, "typeVersion": 1}, {"name": "Add bind-tools", "type": "n8n-nodes-base.executeCommand", "color": "#FF8000", "notes": "Install bind-tools", "position": [480, 180], "parameters": {"command": "=which dig || apk add bind-tools"}, "retryOnFail": true, "typeVersion": 1, "continueOnFail": true, "waitBetweenTries": 1000}, {"name": "dig check CF", "type": "n8n-nodes-base.executeCommand", "color": "#FF8000", "notes": "Install bind-tools", "position": [1300, -50], "parameters": {"command": "=dig NS  {{$node[\"Webhook\"].data[\"query\"][\"q\"]}} +short | grep cloudflare.com.$ | wc -l"}, "retryOnFail": true, "typeVersion": 1, "continueOnFail": true, "waitBetweenTries": 1000}, {"name": "IF", "type": "n8n-nodes-base.if", "position": [1550, -50], "parameters": {"conditions": {"number": [{"value1": "= {{$node[\"dig check CF\"].data[\"stdout\"]}}", "operation": "larger"}]}}, "typeVersion": 1}, {"name": "Mail CloudFlare", "type": "n8n-nodes-base.mailgun", "position": [1830, 160], "parameters": {"text": "=Hello,\n\nI am emailing you to let you know about a Steam phishing website on your network: {{$node[\"Webhook\"].data[\"query\"][\"q\"]}}.\n\nThank you,\nYour Name Here", "ccEmail": "yourCCemail", "subject": "={{$node[\"Webhook\"].data[\"query\"][\"q\"]}} - Steam Phishing Website on your network", "toEmail": "security@cloudflare.com", "fromEmail": "yourFROMemail"}, "credentials": {"mailgunApi": "Mailgun"}, "typeVersion": 1}, {"name": "Mail Steam", "type": "n8n-nodes-base.mailgun", "position": [1830, 340], "parameters": {"text": "=Hello,\n\nI am emailing you to let you know about a Steam phishing website: {{$node[\"Webhook\"].data[\"query\"][\"q\"]}}.\n\nThank you,\nYour Name Here", "ccEmail": "yourCCemail", "subject": "={{$node[\"Webhook\"].data[\"query\"][\"q\"]}} - Steam Phishing Website", "toEmail": "security@valvesoftware.com", "fromEmail": "yourFROMemail"}, "credentials": {"mailgunApi": "Mailgun"}, "typeVersion": 1}, {"name": "dig check if domain is valid", "type": "n8n-nodes-base.executeCommand", "color": "#FF8000", "notes": "Install bind-tools", "position": [720, 180], "parameters": {"command": "=dig NS  {{$node[\"Webhook\"].data[\"query\"][\"q\"]}} +short | wc -l"}, "retryOnFail": true, "typeVersion": 1, "continueOnFail": true, "waitBetweenTries": 1000}, {"name": "If it has nameservers", "type": "n8n-nodes-base.if", "position": [970, 180], "parameters": {"conditions": {"number": [{"value1": "= {{$node[\"dig check if domain is valid\"].data[\"stdout\"]}}", "operation": "larger"}]}}, "typeVersion": 1}, {"name": "IF1", "type": "n8n-nodes-base.if", "position": [270, 200], "parameters": {"conditions": {"string": [{"value1": "={{$node[\"Webhook\"].data[\"query\"][\"q\"]}}", "value2": "/^[a-zA-Z0-9-_.]+$/", "operation": "regex"}]}}, "typeVersion": 1}], "active": false, "settings": {}, "connections": {"IF": {"main": [[{"node": "Mail CloudFlare", "type": "main", "index": 0}]]}, "IF1": {"main": [[{"node": "Add bind-tools", "type": "main", "index": 0}]]}, "Webhook": {"main": [[{"node": "IF1", "type": "main", "index": 0}]]}, "dig check CF": {"main": [[{"node": "IF", "type": "main", "index": 0}]]}, "Add bind-tools": {"main": [[{"node": "dig check if domain is valid", "type": "main", "index": 0}]]}, "If it has nameservers": {"main": [[{"node": "dig check CF", "type": "main", "index": 0}, {"node": "Mail Steam", "type": "main", "index": 0}]]}, "dig check if domain is valid": {"main": [[{"node": "If it has nameservers", "type": "main", "index": 0}]]}}}