Ping IP Reputation Monitor with Slack Alerts (n8n Workflow)

Monitor IP reputation changes and get Slack alerts—automatically

This n8n workflow checks your watched IP addresses against the free PING IP reputation API (https://pingip.co) every day, compares results to the previous run, and sends a Slack alert via webhook only when important reputation or classification values change.

What this workflow does

• Runs on a daily schedule at 09:00 using an n8n Schedule Trigger.
• Loads your IP watchlist and processes each address one by one.
• For each IP, it queries https://pingip.co/api/ip to retrieve reputation/classification data such as risk score, IP type, ASN, country, and a proxy/VPN flag (as provided by PING IP).
• Compares today’s results to the previous run using workflow static data.
• Builds a human-readable change summary and posts to Slack only when tracked values changed (risk score, IP type, ASN, country, or proxy/VPN status).

Setup

• Update the IP list in the watchlist step with the addresses you want to monitor.
• Create a Slack incoming webhook and paste its URL into the alert request (or use another JSON-accepting webhook endpoint like Discord/Teams).
• Activate the workflow. The first run creates a baseline and typically sends no alerts.

Use cases

• Detect when risk score or proxy/VPN status changes for IPs related to sign-ups, logins, or admin access.
• Monitor ASN and country shifts that may indicate fraud infrastructure changes.
• Keep SaaS security and operations teams informed with daily, change-only Slack notifications.

Technical details

• n8n nodes/workflow components: Schedule Trigger, http request, if, code, no op, sticky note.
• Integrations: Slack incoming webhook and the free PING IP API (no API key required).