n8n Threat Intel Workflow: URL & IP Lookup via Greynoise/VT

Threat Intel in Minutes: URL & IP Lookup with GreyNoise + VirusTotal (n8n Workflow)

This n8n threat intelligence workflow automatically enriches URLs and IP addresses using GreyNoise and VirusTotal. Feed it a URL or IP via a form submission or webhook trigger, and it returns a consolidated reputation and malware assessment—including classification, location, tags, and trust signals.

What this workflow does

• Starts from a form submission or webhook trigger and accepts input that may be a URL or an IP.
• Splits logic based on input type (IP vs. URL).
• If the input is an IP, it sets an ip variable to that value.
• If the input is a URL, it performs a DNS lookup using Google Public DNS and sets ip from the lookup results.
• Enriches the IP with GreyNoise in two parallel branches:
  • GreyNoise RIOT IP Lookup for reputation/benign association.
  • GreyNoise IP Context to evaluate potential threats.
• Merges GreyNoise results to produce a comprehensive analysis (IP, classification such as benign/malicious/unknown, location, tags, category, and trust level).
• Initiates a VirusTotal scan for the URL/IP, waits 5 seconds, then polls for scan completion.
• Summarizes results, including overall vendor analysis outcomes, blockList analysis, OpenPhish analysis, plus the analyzed URL and IP.

Use cases

• Security teams enriching indicators from ticketing workflows or webhook feeds.
• SaaS operators checking customer-submitted URLs/IPs for suspicious activity.
• Automation engineers building an on-demand “threat intel lookup” endpoint inside n8n.

Technical details

• Workflow control: if, set, code, wait, merge
• Integrations/automation nodes mentioned: gmail (node included in the workflow), plus threat intel steps for GreyNoise (RIOT IP Lookup, IP Context) and VirusTotal