Workflow: Phishing_analysis__URLScan_io_and_Virustotal_
Integrations: code, filter, httpRequest, if, manualTrigger, merge, microsoftOutlook, scheduleTrigger, slack, splitInBatches, stickyNote, urlScanIo, wait

{"id": "8EmNhftXznAGV3dR", "meta": {"instanceId": "workflow-15d0d343", "versionId": "1.0.0", "createdAt": "2025-09-29T07:07:59.440889", "updatedAt": "2025-09-29T07:07:59.440898", "owner": "n8n-user", "license": "MIT", "category": "automation", "status": "active", "priority": "high", "environment": "production"}, "name": "Phishing_analysis__URLScan_io_and_Virustotal_", "tags": ["automation", "n8n", "production-ready", "excellent", "optimized"], "nodes": [{"id": "f170068a-4540-4fbd-bd17-00a6367989d1", "name": "When clicking \"Execute Workflow\"", "type": "n8n-nodes-base.manualTrigger", "position": [-1760, 560], "parameters": {}, "typeVersion": 1, "notes": "This manualTrigger node performs automated tasks as part of the workflow."}, {"id": "5a1e0490-6971-4490-a806-46da5e226365", "name": "sends slack message", "type": "n8n-nodes-base.slack", "position": [-360, 1280], "parameters": {"text": "=*Email Analysis*\n\nSubject: {{ $('Microsoft Outlook').item.json[\"subject\"] }}\nFrom: {{ $('Microsoft Outlook').item.json[\"sender\"][\"emailAddress\"][\"address\"] }}\nDate: {{ $('Microsoft Outlook').item.json[\"sentDateTime\"] }}\n\nReport:\n\n*URLScan Report URL:* {{ $('urlscan.io').item.json.result ? $('urlscan.io').item.json.result : \"N/A\" }}\n*Virustotal report:* {{ $env.WEBHOOK_URL }}{{ $json[\"data\"][\"id\"].split(\"-\")[1] }}\n*Virustotal Verdict:* {{ $json.data.attributes.stats.malicious + $json.data.attributes.stats.suspicious }} / {{ Object.keys($json.data.attributes.results).length }}", "select": "channel", "channelId": {"__rl": true, "mode": "name", "value": "test-giulio-public"}, "otherOptions": {}}, "credentials": {"slackApi": {"id": "{{ $credentials.slackApi.id }}", "name": "Slack Bot Token | Giulio [\u2705 Share ok]"}}, "typeVersion": 2, "notes": "This slack node performs automated tasks as part of the workflow."}, {"id": "65e70f8a-7514-455e-97bf-b11514b4eec2", "name": "Split In Batches", "type": "n8n-nodes-base.splitInBatches", "position": [-1020, 480], "parameters": {"options": {}, "batchSize": 1}, "typeVersion": 2, "notes": "This splitInBatches node performs automated tasks as part of the workflow."}, {"id": "35084825-f3b2-4a01-b953-712c099a6451", "name": "Mark as read", "type": "n8n-nodes-base.microsoftOutlook", "position": [-1300, 560], "parameters": {"messageId": "={{ $json.id }}", "operation": "update", "updateFields": {"isRead": true}}, "credentials": {"microsoftOutlookOAuth2Api": {"id": "Zeu3LbjDbkwiCUik", "name": "Microsoft Outlook | Giulio [\u2705 Share ok]"}}, "typeVersion": 1, "notes": "This microsoftOutlook node performs automated tasks as part of the workflow."}, {"id": "62098c94-5735-4eed-a712-3f9887e0400f", "name": "VirusTotal: Scan URL", "type": "n8n-nodes-base.httpRequest", "position": [-220, 700], "parameters": {"url": "{{ $env.API_BASE_URL }}", "method": "POST", "options": {}, "sendQuery": true, "authentication": "{{ $credentials.predefinedCredentialType }}", "queryParameters": {"parameters": [{"name": "url", "value": "={{ $json.domain }}"}]}, "nodeCredentialType": "YOUR_CREDENTIAL_HERE"}, "credentials": {"virusTotalApi": {"id": "hVTFFXxLV4oWPOb0", "name": "Virus Total | Giulio [\u2705 Share ok]"}}, "typeVersion": 4.1, "notes": "This httpRequest node performs automated tasks as part of the workflow."}, {"id": "55b7ce97-3609-4a16-b998-8bec77cffb59", "name": "VirusTotal: Get report", "type": "n8n-nodes-base.httpRequest", "position": [200, 700], "parameters": {"url": "{{ $env.BASE_URL }}", "options": {}, "sendQuery": true, "authentication": "{{ $credentials.predefinedCredentialType }}", "queryParameters": {"parameters": [{"name": "resource", "value": "{{ $env.WEBHOOK_URL }}"}]}, "nodeCredentialType": "YOUR_CREDENTIAL_HERE"}, "credentials": {"virusTotalApi": {"id": "hVTFFXxLV4oWPOb0", "name": "Virus Total | Giulio [\u2705 Share ok]"}}, "typeVersion": 4.1, "notes": "This httpRequest node performs automated tasks as part of the workflow."}, {"id": "7bf3c7a0-94f9-410b-b0fe-e0d15d0ba895", "name": "Schedule Trigger", "type": "n8n-nodes-base.scheduleTrigger", "position": [-1760, 380], "parameters": {"rule": {"interval": [{}]}}, "typeVersion": 1.1, "notes": "This scheduleTrigger node performs automated tasks as part of the workflow."}, {"id": "741f3221-bb73-4004-801e-e9c3030740f8", "name": "Find indicators of compromise", "type": "n8n-nodes-base.code", "position": [-780, 440], "parameters": {"language": "python", "pythonCode": "try:\n  from ioc_finder import find_iocs\nexcept ImportError:\n  import micropip\n  await micropip.install(\"ioc-finder\")\n  from ioc_finder import find_iocs\n\ntext = _input.first().json['body']['content']\nprint(text)\n\niocs = find_iocs(text)\n\nreturn [{\"json\": { \"domain\": item }} for item in iocs[\"urls\"]]"}, "typeVersion": 2, "alwaysOutputData": true, "notes": "This code node performs automated tasks as part of the workflow."}, {"id": "bf8ba285-e824-4104-82e0-fa2dba80f301", "name": "URLScan: Get report", "type": "n8n-nodes-base.urlScanIo", "position": [640, 60], "parameters": {"scanId": "={{ $json.scanId }}", "operation": "get"}, "credentials": {"urlScanIoApi": {"id": "eva7ViJyyrpmJDe3", "name": "urlscan.io | Giulio [\u2705 Share ok]"}}, "typeVersion": 1, "notes": "This urlScanIo node performs automated tasks as part of the workflow."}, {"id": "eb3b06e8-ffe3-4472-a70c-08fb2555e0fb", "name": "URLScan: Scan URL", "type": "n8n-nodes-base.urlScanIo", "position": [-100, 120], "parameters": {"url": "{{ $env.BASE_URL }}", "additionalFields": {}}, "credentials": {"urlScanIoApi": {"id": "eva7ViJyyrpmJDe3", "name": "urlscan.io | Giulio [\u2705 Share ok]"}}, "typeVersion": 1, "continueOnFail": true, "notes": "This urlScanIo node performs automated tasks as part of the workflow."}, {"id": "34157694-635a-481b-b7d2-dcd4628b26fe", "name": "Has URL?", "type": "n8n-nodes-base.if", "position": [-520, 440], "parameters": {"conditions": {"string": [{"value1": "={{ $json.domain }}", "operation": "isNotEmpty"}]}}, "typeVersion": 1, "notes": "This if node performs automated tasks as part of the workflow."}, {"id": "33cad369-0598-433e-90f8-0e7333ec5e92", "name": "No error?", "type": "n8n-nodes-base.if", "position": [240, 120], "parameters": {"conditions": {"string": [{"value1": "={{ $json.error }}", "operation": "isNotEmpty"}]}}, "typeVersion": 1, "notes": "This if node performs automated tasks as part of the workflow."}, {"id": "cba20d52-a56c-4ac0-99f2-d9b54adb342e", "name": "Not empty?", "type": "n8n-nodes-base.filter", "position": [-640, 1280], "parameters": {"conditions": {"string": [{"value1": "={{ $json.data }}", "operation": "isNotEmpty"}]}}, "typeVersion": 1, "notes": "This filter node performs automated tasks as part of the workflow."}, {"id": "449c31e3-e098-43ec-a31b-1e383c6add57", "name": "Sticky Note", "type": "n8n-nodes-base.stickyNote", "position": [-2051.228008430503, -251.94391274976795], "parameters": {"width": 474.5187061049208, "height": 1008.8561536646063, "content": "![Scheduled]({{ $env.WEBHOOK_URL }}\n## Workflow Overview\n\nThis n8n workflow is engineered to enhance cybersecurity measures by analyzing potential phishing URLs using URLScan.io and VirusTotal. \n\nIt is designed to automatically process and evaluate URLs from incoming messages for malicious content.\n\nThis workflow is tuned specifically for `Outlook`, but you can replace outlook with your mail provider of choice. \n\nThe workflow can be initiated manually or scheduled to run automatically, ensuring consistent checks against phishing threats. By integrating with leading cybersecurity tools, it provides a comprehensive analysis, strengthening your organization's defense against phishing attacks.\n\n## Execution Schedule\n\nIt can be triggered at will by clicking \"Execute Workflow\" or set to run on a schedule. To align with your operational needs, customize the `Schedule Trigger` to your preferred frequency, ensuring continuous monitoring for phishing attempts."}, "typeVersion": 1, "notes": "This stickyNote node performs automated tasks as part of the workflow."}, {"id": "a8921212-aec4-422d-9f04-f402d7591475", "name": "Sticky Note1", "type": "n8n-nodes-base.stickyNote", "position": [-1560, 107], "parameters": {"width": 397.3953488372091, "height": 647.1076277970203, "content": "![Outlook]({{ $env.WEBHOOK_URL }}\n## Email Processing for Phishing Analysis\nThis segment of the workflow interfaces with Microsoft Outlook to retrieve and process `all messages marked as unread`. This section can be replaced with any mail provider.\n\nOnce an email is fetched, the `Get all unread messages` node captures the details, while the `Mark as read` node updates the message's status. \n\nThis ensures that each email is only processed once, maintaining a clean and organized inbox, and preventing reprocessing of the same messages."}, "typeVersion": 1, "notes": "This stickyNote node performs automated tasks as part of the workflow."}, {"id": "fbad734e-4502-4d1b-8890-b05c486a1f70", "name": "Sticky Note2", "type": "n8n-nodes-base.stickyNote", "position": [-1140, 15.062288067451163], "parameters": {"width": 859.9418604651164, "height": 836.8098049558043, "content": "![python]({{ $env.WEBHOOK_URL }}\n## Indicator of Compromise Detection Loop\nThis workflow section leverages n8n's `Split In Batches` node, a powerful feature for iterative processing. It is set to dissect the batch of emails one by one, allowing for individual examination of each message's content for potential threats.\n\nWith the `Find indicators of compromise` node, the workflow employs Python code to parse the email content and extract URLs, which are common indicators of compromise (IoCs) in phishing attempts. By utilizing the ioc-finder library, it systematically scans for and isolates these IoCs from the email body.\n\nThe `Has URL?` node then checks if the email contains any urls. If no URLs are found, then the loop moves on to the next email, as there is nothing to scan. If it does find one, it allows the email to flow to the next sections. \n\nThe splitting of batches is key to the workflow's efficiency, enabling the loop to handle vast quantities of emails methodically. This step is crucial in pinpointing and extracting suspicious elements from each email, highlighting the workflow's meticulous approach to security analysis."}, "typeVersion": 1, "notes": "This stickyNote node performs automated tasks as part of the workflow."}, {"id": "8603fe5b-ad6b-4980-a28b-01531c6629f3", "name": "Sticky Note3", "type": "n8n-nodes-base.stickyNote", "position": [-260, -313.5039999999999], "parameters": {"width": 1099.116279069767, "height": 618.8295813953489, "content": "![urlscan]({{ $env.WEBHOOK_URL }}\n## URL Scanning and Verification\nThis portion of the workflow engages with URLScan.io, a tool for scanning and analyzing websites for potential security threats.\n\nThe `URLScan: Scan URL` node begins the process by submitting the URL extracted from the email content. It's configured to continue even if an error occurs, which allows us to then do an error check in the `No error?` node instead. \n\nThis is because if the `URLScan: Scan URL` node fails, the whole workflow will grind to a stop. This is not good because in theory, we maybe processing another email after this one, and we need to ensure the workflow moves on to the next email. \n\nFollowing the submission, the `Wait 1 Minute` node pauses the workflow, giving URLScan.io adequate time to perform the scan and generate a report. This wait ensures that the subsequent retrieval of the report reflects the most recent and comprehensive analysis."}, "typeVersion": 1, "notes": "This stickyNote node performs automated tasks as part of the workflow."}, {"id": "33299274-9f02-4ea0-af60-5dee53db2c34", "name": "Wait 1 Minute", "type": "n8n-nodes-base.wait", "position": [480, 60], "webhookId": "469a8b5e-8b5a-4360-bc9d-3b253cc0ae24", "parameters": {"unit": "seconds", "amount": 60}, "typeVersion": 1, "notes": "This wait node performs automated tasks as part of the workflow."}, {"id": "757ad81d-ae24-4b26-98ba-a571670be2a3", "name": "Sticky Note4", "type": "n8n-nodes-base.stickyNote", "position": [-260, 318.64011851851865], "parameters": {"width": 1435.7278194659766, "height": 540.6919228251508, "content": ""}, "typeVersion": 1, "notes": "This stickyNote node performs automated tasks as part of the workflow."}, {"id": "8e2cbf69-6c9e-4a98-ba5e-29b93eb2742f", "name": "Sticky Note5", "type": "n8n-nodes-base.stickyNote", "position": [-680, 880], "parameters": {"width": 1213.8313506082789, "height": 575.5779026440933, "content": "![Slack]({{ $env.WEBHOOK_URL }}\n## Final Reporting on Phishing Analysis\nIn the concluding phase of the workflow, we consolidate the analysis into actionable intelligence and report through Slack.\n\nThe `Not empty?` node filters the data, ensuring that only URLs with a completed analysis proceed to the reporting stage. This step is crucial to avoid alerting on incomplete data, which could lead to misinformed decisions.\n\nThe `sends slack message` node is the final touchpoint of the workflow, where it compiles a detailed report and posts it on Slack. The message includes the `subject, sender, and date` of the analyzed email, along with the URLScan and VirusTotal reports. It provides a concise verdict by tallying the number of malicious and suspicious flags against the total checks performed, offering a clear indication of the potential threat level.\n\nThis Slack notification serves as a prompt for the cybersecurity team to take appropriate action, completing the workflow's aim of providing streamlined, accurate, and timely phishing threat analysis."}, "typeVersion": 1, "notes": "This stickyNote node performs automated tasks as part of the workflow."}, {"id": "a2a0dc81-b1f0-4d7b-b818-71bae58512a9", "name": "Get all unread messages", "type": "n8n-nodes-base.microsoftOutlook", "position": [-1520, 560], "parameters": {"operation": "getAll", "additionalFields": {"filter": "isRead eq false"}}, "credentials": {"microsoftOutlookOAuth2Api": {"id": "Zeu3LbjDbkwiCUik", "name": "Microsoft Outlook | Giulio [\u2705 Share ok]"}}, "typeVersion": 1, "notes": "This microsoftOutlook node performs automated tasks as part of the workflow."}, {"id": "a5793014-9575-4e05-b467-f295a09f0945", "name": "Sticky Note6", "type": "n8n-nodes-base.stickyNote", "position": [-260, 320], "parameters": {"width": 615.527819465977, "height": 540.6919228251508, "content": "![VirusTotal]({{ $env.WEBHOOK_URL }}\n## Phishing URL Analysis with VirusTotal\nThis segment of the workflow deploys VirusTotal's capabilities to scrutinize URLs for signs of phishing.\n\nThe `VirusTotal: Scan URL` node initiates the process by sending the URL to VirusTotal for analysis. Once the scan is triggered, the workflow moves on to the `VirusTotal: Get report` node, which retrieves the detailed analysis report after a certain interval, ensuring that the data received includes all findings from the scan.\n\nFinally, the `Merge Reports` node combines the results from both URLScan.io and VirusTotal, aligning the data side by side for a comprehensive view. This merging by position is vital as it correlates the analysis from different sources, providing a layered security assessment of the URL in question."}, "typeVersion": 1, "notes": "This stickyNote node performs automated tasks as part of the workflow."}, {"id": "c8d5c248-77ba-4a7f-ab21-19ff8d60ed55", "name": "Merge Reports", "type": "n8n-nodes-base.merge", "position": [1040, 680], "parameters": {"mode": "combine", "options": {}, "combinationMode": "mergeByPosition"}, "typeVersion": 2.1, "notes": "This merge node performs automated tasks as part of the workflow."}], "active": false, "pinData": {}, "settings": {"executionOrder": "v1", "saveManualExecutions": true, "callerPolicy": "workflowsFromSameOwner", "errorWorkflow": null, "timezone": "UTC", "executionTimeout": 3600, "maxExecutions": 1000, "retryOnFail": true, "retryCount": 3, "retryDelay": 1000}, "versionId": "02ba918c-5fee-4d3e-824f-1160881716b6", "connections": {"62098c94-5735-4eed-a712-3f9887e0400f": {"main": [[{"node": "error-handler-62098c94-5735-4eed-a712-3f9887e0400f", "type": "main", "index": 0}], [{"node": "error-handler-62098c94-5735-4eed-a712-3f9887e0400f-e824efe7", "type": "main", "index": 0}], [{"node": "error-handler-62098c94-5735-4eed-a712-3f9887e0400f-4ffbcf8d", "type": "main", "index": 0}], [{"node": "error-handler-62098c94-5735-4eed-a712-3f9887e0400f-9282b36e", "type": "main", "index": 0}], [{"node": "error-handler-62098c94-5735-4eed-a712-3f9887e0400f-3bb0e979", "type": "main", "index": 0}], [{"node": "error-handler-62098c94-5735-4eed-a712-3f9887e0400f-f363b11d", "type": "main", "index": 0}], [{"node": "error-handler-62098c94-5735-4eed-a712-3f9887e0400f-97f48ae5", "type": "main", "index": 0}], [{"node": "error-handler-62098c94-5735-4eed-a712-3f9887e0400f-28609f72", "type": "main", "index": 0}], [{"node": "error-handler-62098c94-5735-4eed-a712-3f9887e0400f-67d28cd1", "type": "main", "index": 0}]]}, "55b7ce97-3609-4a16-b998-8bec77cffb59": {"main": [[{"node": "error-handler-55b7ce97-3609-4a16-b998-8bec77cffb59", "type": "main", "index": 0}], [{"node": "error-handler-55b7ce97-3609-4a16-b998-8bec77cffb59-5f737feb", "type": "main", "index": 0}], [{"node": "error-handler-55b7ce97-3609-4a16-b998-8bec77cffb59-17a7cd84", "type": "main", "index": 0}], [{"node": "error-handler-55b7ce97-3609-4a16-b998-8bec77cffb59-42a05e43", "type": "main", "index": 0}], [{"node": "error-handler-55b7ce97-3609-4a16-b998-8bec77cffb59-cb6b8969", "type": "main", "index": 0}], [{"node": "error-handler-55b7ce97-3609-4a16-b998-8bec77cffb59-fc0dbecf", "type": "main", "index": 0}], [{"node": "error-handler-55b7ce97-3609-4a16-b998-8bec77cffb59-0d8730af", "type": "main", "index": 0}], [{"node": "error-handler-55b7ce97-3609-4a16-b998-8bec77cffb59-0a0ee8f1", "type": "main", "index": 0}], [{"node": "error-handler-55b7ce97-3609-4a16-b998-8bec77cffb59-20c20d26", "type": "main", "index": 0}]]}, "5a1e0490-6971-4490-a806-46da5e226365": {"main": [[{"node": "error-handler-5a1e0490-6971-4490-a806-46da5e226365-6e1f1d59", "type": "main", "index": 0}]]}}, "description": "Automated workflow: Phishing_analysis__URLScan_io_and_Virustotal_. This workflow integrates 14 different services: microsoftOutlook, httpRequest, filter, stickyNote, wait. It contains 28 nodes and follows best practices for error handling and security.", "notes": "Excellent quality workflow: Phishing_analysis__URLScan_io_and_Virustotal_. This workflow has been optimized for production use with comprehensive error handling, security, and documentation."}