n8n URL Phishing Check Workflow: VirusTotal, Safe Browsing

Check any URL for phishing and malware risk—instantly—using Google Safe Browsing + VirusTotal, then summarize with Gemini

This n8n URL Phishing Check Workflow automatically takes a URL submitted via an n8n form, validates it against Google Safe Browsing and VirusTotal, enriches it with domain/SSL intelligence (RDAP, crt.sh, IP geolocation), and uses Google Gemini 3.1 Flash Lite to generate a plain-English verdict. Results are logged to Google Sheets and sent to Slack for fast team response.

What this workflow does

• Receives a URL submission through an n8n form trigger.
• Normalizes the input by extracting the domain and adding a scan timestamp.
• Checks the URL against Google Safe Browsing and retrieves hosting/IP geolocation from ip-api.com.
• Enriches the domain with registration details via RDAP and SSL/certificate history from crt.sh.
• Submits the URL to VirusTotal, waits briefly, then pulls the analysis report.
• Aggregates signals into a 0–100 risk score and assigns a risk level (Low/Medium/High) based on Safe Browsing, VirusTotal detections, domain age, and certificate history.
• Uses Google Gemini 3.1 Flash Lite to produce a short verdict summary and a recommended next action.
• Appends or updates the scan record in Google Sheets and posts the result to a Slack channel.

Use cases

• Rapidly triage suspicious links reported by users or employees.
• Automate pre-block checks for SaaS customer support phishing attempts.
• Security ops workflows that require consistent URL scoring and audit logging in Google Sheets.
• Incident response support with Slack notifications and human-readable Gemini guidance.

Technical details

• APIs/integrations: Google Safe Browsing, VirusTotal, ip-api.com, RDAP, crt.sh, Google Gemini 3.1 Flash Lite, Google Sheets, Slack.
• n8n nodes used: form trigger, set, code, wait, slack, plus supportive steps (e.g., sticky note).

Setup: Add API keys for Google Safe Browsing and VirusTotal, and configure the Google Service Account for Google Sheets.