Automate Phishing Detection: n8n URLScan & VirusTotal Workflow

Transform your email security monitoring with this powerful n8n workflow that automatically scans Microsoft Outlook emails for malicious URLs using URLScan.io and VirusTotal threat intelligence services. Perfect for security teams who need automated phishing detection and threat analysis.

What this workflow does

This comprehensive email security automation retrieves up to 100 email messages from your Microsoft Outlook inbox and systematically analyzes them for indicators of compromise (IOCs). The workflow can run on-demand or automatically execute daily at midnight for continuous monitoring.

The process begins by fetching emails from your Outlook inbox and marking them as read to prevent duplicate processing. Using the Split In Batches node, each email is processed individually to extract and analyze any URLs found in the message content. When URLs are detected, the workflow simultaneously queries both URLScan.io and VirusTotal APIs for comprehensive threat assessment.

The dual-path analysis includes intelligent error handling - if URLScan.io encounters issues, the system waits 60 seconds before retrying. Results from both security services are merged and filtered to remove empty datasets. Finally, a detailed Slack notification summarizes the findings, including email subject, sender information, date, URLScan report URL, and VirusTotal analysis results.

Use cases

• Automated phishing detection for corporate email security monitoring
• Daily threat intelligence gathering from incoming business communications
• SOC team workflows for processing suspicious email reports
• Compliance monitoring for organizations requiring email security auditing

Technical details

This n8n automation workflow leverages multiple specialized nodes including If conditions for logic branching, Code nodes for URL extraction, Wait nodes for retry mechanisms, Merge nodes for combining threat intelligence data, Filter nodes for data cleanup, and Slack integration for notifications. The workflow integrates with Microsoft Outlook, URLScan.io, VirusTotal, and Slack APIs.

Ready to enhance your email security posture? Deploy this automated phishing detection workflow and start identifying threats in your inbox today.