{"product_id":"n8n-url-phishing-check-workflow-virustotal-safe-browsing","title":"n8n URL Phishing Check Workflow: VirusTotal, Safe Browsing","description":"\u003ch3\u003eCheck any URL for phishing and malware risk—instantly—using Google Safe Browsing + VirusTotal, then summarize with Gemini\u003c\/h3\u003e\n\u003cp\u003eThis n8n URL Phishing Check Workflow automatically takes a URL submitted via an n8n form, validates it against \u003cstrong\u003eGoogle Safe Browsing\u003c\/strong\u003e and \u003cstrong\u003eVirusTotal\u003c\/strong\u003e, enriches it with domain\/SSL intelligence (RDAP, \u003cstrong\u003ecrt.sh\u003c\/strong\u003e, IP geolocation), and uses \u003cstrong\u003eGoogle Gemini 3.1 Flash Lite\u003c\/strong\u003e to generate a plain-English verdict. Results are logged to \u003cstrong\u003eGoogle Sheets\u003c\/strong\u003e and sent to \u003cstrong\u003eSlack\u003c\/strong\u003e for fast team response.\u003c\/p\u003e\n\n\u003ch3\u003eWhat this workflow does\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003eReceives a URL submission through an \u003cstrong\u003en8n form trigger\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003eNormalizes the input by extracting the domain and adding a scan timestamp.\u003c\/li\u003e\n  \u003cli\u003eChecks the URL against \u003cstrong\u003eGoogle Safe Browsing\u003c\/strong\u003e and retrieves hosting\/IP geolocation from \u003cstrong\u003eip-api.com\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003eEnriches the domain with registration details via \u003cstrong\u003eRDAP\u003c\/strong\u003e and SSL\/certificate history from \u003cstrong\u003ecrt.sh\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003eSubmits the URL to \u003cstrong\u003eVirusTotal\u003c\/strong\u003e, waits briefly, then pulls the analysis report.\u003c\/li\u003e\n  \u003cli\u003eAggregates signals into a \u003cstrong\u003e0–100 risk score\u003c\/strong\u003e and assigns a risk level (\u003cstrong\u003eLow\/Medium\/High\u003c\/strong\u003e) based on Safe Browsing, VirusTotal detections, domain age, and certificate history.\u003c\/li\u003e\n  \u003cli\u003eUses \u003cstrong\u003eGoogle Gemini 3.1 Flash Lite\u003c\/strong\u003e to produce a short verdict summary and a recommended next action.\u003c\/li\u003e\n  \u003cli\u003eAppends or updates the scan record in \u003cstrong\u003eGoogle Sheets\u003c\/strong\u003e and posts the result to a \u003cstrong\u003eSlack\u003c\/strong\u003e channel.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eUse cases\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003eRapidly triage suspicious links reported by users or employees.\u003c\/li\u003e\n  \u003cli\u003eAutomate pre-block checks for SaaS customer support phishing attempts.\u003c\/li\u003e\n  \u003cli\u003eSecurity ops workflows that require consistent URL scoring and audit logging in Google Sheets.\u003c\/li\u003e\n  \u003cli\u003eIncident response support with Slack notifications and human-readable Gemini guidance.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eTechnical details\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003eAPIs\/integrations: \u003cstrong\u003eGoogle Safe Browsing\u003c\/strong\u003e, \u003cstrong\u003eVirusTotal\u003c\/strong\u003e, \u003cstrong\u003eip-api.com\u003c\/strong\u003e, \u003cstrong\u003eRDAP\u003c\/strong\u003e, \u003cstrong\u003ecrt.sh\u003c\/strong\u003e, \u003cstrong\u003eGoogle Gemini 3.1 Flash Lite\u003c\/strong\u003e, \u003cstrong\u003eGoogle Sheets\u003c\/strong\u003e, \u003cstrong\u003eSlack\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003en8n nodes used: \u003cstrong\u003eform trigger\u003c\/strong\u003e, \u003cstrong\u003eset\u003c\/strong\u003e, \u003cstrong\u003ecode\u003c\/strong\u003e, \u003cstrong\u003ewait\u003c\/strong\u003e, \u003cstrong\u003eslack\u003c\/strong\u003e, plus supportive steps (e.g., \u003cstrong\u003esticky note\u003c\/strong\u003e).\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSetup:\u003c\/strong\u003e Add API keys for Google Safe Browsing and VirusTotal, and configure the Google Service Account for Google Sheets.\u003c\/p\u003e","brand":"N8N Commerce","offers":[{"title":"Default Title","offer_id":45985530937523,"sku":"N8N-19380","price":16.99,"currency_code":"GBP","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0749\/6279\/6723\/files\/8g3j96CwcxTCVPwaJiTi8_ASpjGiPQ.png?v=1788945642","url":"https:\/\/buyflowscripts.com\/products\/n8n-url-phishing-check-workflow-virustotal-safe-browsing","provider":"N8N Commerce","version":"1.0","type":"link"}