HumationHuman + Automation
Back to Catalog

URL and IP lookups through Greynoise and VirusTotal

n8n Teamn8n Team
9702 views
2/3/2026
notificationsexchange ratewebhookdiscordcurrency
Official Page

This n8n workflow serves as a powerful cybersecurity and threat intelligence tool to look up URLs or IP addresses through industry standard threat intelligence vendors. It starts with either a form submission or a webhook trigger, allowing users to input data, URLs or IPs that require analysis. The workflow then splits into two paths depending on whether the input data is an IP or URL. If an IP was given, it sets the ip variable to the IP; however if a URL was given the workflow will perform a DNS lookup using Google Public DNS and sets the ip variable based on the results from Google.

The workflow then checks the obtained IP addresses against GreyNoise services, with one branch utilizing GreyNoise RIOT IP Lookup to assess IP reputation and association with known benign services, and the other using GreyNoise IP Context to evaluate potential threats. The results from both GreyNoise services are merged to create a comprehensive analysis which includes the IP, classification (benign, malicious, or unknown), IP location, tags to identify activity or malware, category, and trust level.

In parallel, a VirusTotal scan is initiated for the URL/IP to identify if it is malicious. A 5-second wait ensures proper processing, and the workflow subsequently polls the scan result to determine when the analysis is complete. The workflow then summarizes the analysis including the overall security vendor analysis results, blockList analysis, OpenPhish analysis, the URL, and the IP.

Finally, the workflow combines the summarized intelligence from both GreyNoise and VirusTotal to provide a thorough analysis of the URL/IP. This summarized intelligence can then be emailed to the user that filled out the form via Gmail or it can be sent to the user via a Slack message.

Setting up this workflow may require proper configuration of the form submission or webhook trigger, and ensuring that the GreyNoise and VirusTotal API credentials are correctly integrated. Users should also consider the potential volume of data and API rate limits, as excessive requests could lead to issues. Proper documentation and validation of input data are crucial to ensure accurate and meaningful results in the final report.

n8n Workflow: URL and IP Lookups through GreyNoise and VirusTotal

This n8n workflow provides a robust solution for performing security lookups on URLs and IP addresses using GreyNoise and VirusTotal. It streamlines the process of analyzing potential threats by integrating with these reputable intelligence services and then reporting the findings to a Slack channel and via email.

What it does

This workflow automates the following steps:

  1. Receives a Form Submission: It starts by listening for a submission to an n8n form, which is expected to contain either a URL or an IP address for analysis.
  2. Determines Input Type: It intelligently checks if the submitted input is a URL or an IP address.
  3. Performs GreyNoise Lookup (for IPs): If the input is an IP address, it queries the GreyNoise API to gather information about the IP's activity and reputation.
  4. Performs VirusTotal Lookup (for URLs): If the input is a URL, it queries the VirusTotal API to check the URL for known malicious content.
  5. Combines Results: It merges the results from the different lookup branches.
  6. Formats Output: It processes and formats the raw API responses into a more readable structure.
  7. Filters for Malicious Findings: It specifically looks for indicators of malicious activity in the lookup results.
  8. Sends Slack Notification: If malicious activity is detected, it sends a detailed alert to a designated Slack channel.
  9. Sends Email Notification: Regardless of the findings, it sends an email with the complete lookup results.

Prerequisites/Requirements

To use this workflow, you will need:

  • n8n Instance: A running instance of n8n.
  • GreyNoise API Key: An API key for GreyNoise.
  • VirusTotal API Key: An API key for VirusTotal.
  • Slack Account: A Slack workspace and a channel to post notifications to.
  • Gmail Account: A configured Gmail credential in n8n for sending email notifications.

Setup/Usage

  1. Import the Workflow: Import the provided JSON into your n8n instance.
  2. Configure Credentials:
    • HTTP Request (GreyNoise): Configure the "HTTP Request" node (ID: 19) for GreyNoise with your API key. This typically involves adding a header for key or X-API-Key.
    • HTTP Request (VirusTotal): Configure the "HTTP Request" node (ID: 19) for VirusTotal with your API key. This typically involves adding a header for x-apikey.
    • Slack: Set up a Slack credential and select it in the "Slack" node (ID: 40). Specify the channel where you want to receive notifications.
    • Gmail: Set up a Gmail OAuth2 credential and select it in the "Gmail" node (ID: 356).
  3. Configure the n8n Form Trigger:
    • Activate the "On form submission" node (ID: 1225).
    • Copy the webhook URL provided by this node.
    • You can then use this URL to submit data (e.g., from another application, a custom form, or manually for testing) with a json body containing a field named input which holds the URL or IP address.
  4. Activate the Workflow: Once all credentials and configurations are set, activate the workflow.

Now, any submission to the n8n form trigger with a URL or IP address will initiate the lookup process, and you will receive notifications on Slack (for malicious findings) and via email (for all results).

Related Templates

Track meal nutrition from meal photos with LINE, Google Gemini and Google Sheets

AI Meal Nutrition Tracker with LINE and Google Sheets Who's it for This workflow is designed for health-conscious individuals, fitness enthusiasts, and anyone who wants to track their daily food intake without manual calorie counting. It is best suited for users who want a simple, AI-powered meal logging system that analyzes food photos one at a time and provides instant nutritional feedback via LINE. What it does This workflow processes a single meal photo sent via LINE, analyzes it using Google Gemini AI to identify foods and estimate nutritional content, and stores the data in Google Sheets for tracking. The workflow focuses on simplicity and encouragement: it receives a meal image, performs AI-based food recognition, estimates calories and macronutrients, calculates a health score, provides personalized advice, and replies with a detailed nutritional breakdown on LINE. How it works A single meal photo is sent to the LINE bot. The workflow is triggered via a LINE webhook. The image file is downloaded and sent to Google Gemini AI for food analysis. The AI identifies foods and estimates nutritional values (calories, protein, carbs, fat, fiber). A health score (1-10) is calculated with personalized improvement tips. The data is appended to Google Sheets for meal history tracking. The image is uploaded to Google Drive for reference. A formatted nutritional report with advice is sent back as a LINE reply. This workflow is intentionally designed to handle one image per execution. Requirements To use this workflow, you will need: A LINE Messaging API account A Google Gemini API key A Google account with access to Google Sheets and Google Drive A Google Sheets document with the following column names: Date Time Meal Type Food Items Calories Protein (g) Carbs (g) Fat (g) Fiber (g) Health Score Advice Image URL Important limitations This workflow does not support multiple images sent in a single message. Sending images in quick succession may trigger multiple executions and lead to unexpected results. Only the first image in an event payload is processed. Nutritional values are AI estimates based on visual analysis and typical serving sizes. Accuracy depends on image quality, lighting, and food visibility. This tool should not replace professional dietary advice. These limitations are intentional to keep the workflow simple and easy to understand. How to set up Create a LINE Messaging API channel and obtain a Channel Access Token. Generate a Google Gemini API key. Update the Config node with your LINE token, Google Sheets ID, Google Drive folder ID, and daily calorie goal. Configure credentials for LINE, Google Gemini, Google Sheets, and Google Drive. Register the n8n webhook URL in your LINE channel settings. Activate the workflow in n8n and test it with a single meal photo. How to customize Modify the AI prompt in the "Analyze Meal with AI" node to support different languages or dietary frameworks (keto, vegan, etc.). Adjust the daily calorie goal in the Config node to match individual needs. Add additional nutritional fields such as sodium, sugar, or vitamins. Replace Google Sheets with a fitness app API or database. Integrate with other services to send daily/weekly nutrition summaries. --- Note: This workflow was tested using real meal photos sent individually via the LINE Messaging API. Nutritional estimates are approximations and may vary from actual values. For accurate dietary tracking, consult a registered dietitian.

Oka HironobuBy Oka Hironobu
89

Track free Udemy courses automatically with RapidAPI and Google Sheets

This workflow fetches free Udemy courses hourly via the Udemy Coupons and Courses API on RapidAPI, filters them, and updates a Google Sheet. It sends alerts on errors for smooth monitoring. --- Node-by-Node Explanation Schedule Trigger: Runs the workflow every hour automatically. Fetch Udemy Coupons: Sends POST request to the Udemy Coupons and Courses API on RapidAPI to get featured courses. Check API Success: Verifies if the API response is successful; routes accordingly. Filter Free Courses: Selects only courses with sale_price of zero (free courses). Send Error Notification: Emails admin if API fetch fails for quick action. Sync Courses to Google Sheet: Appends or updates the filtered free courses into Google Sheets. --- Google Sheets Columns id name price sale_price image lectures views rating language category subcategory slug store sale_start --- Google Sheets Setup & Configuration Steps Create Google Sheet: Create or open a Google Sheet where you want to sync courses. Set Headers: Add columns headers matching the fields synced (id, name, price, etc.). Enable Google Sheets API: Go to Google Cloud Console, enable Google Sheets API for your project. Create Service Account: In Google Cloud Console, create a Service Account with editor access. Download Credentials: Download the JSON credentials file from the service account. Share Sheet: Share your Google Sheet with the Service Account email (found in JSON file). Configure n8n Google Sheets Node: Use the service account credentials, set operation to “Append or Update”, provide Sheet URL and sheet name or gid. Match Columns: Map the course fields to your sheet columns and set id as the unique key for updates. --- How to Obtain RapidAPI Key & Setup API Request Sign up/Login: Visit RapidAPI Udemy Coupons and Courses API and create an account or log in. Subscribe to API: Subscribe to the Udemy Coupons and Courses API plan (free or paid). Get API Key: Navigate to your dashboard and copy your x-rapidapi-key. Configure HTTP Request: In your workflow’s HTTP Request node: Set method to POST. URL: https://udemy-coupons-and-courses.p.rapidapi.com/featured.php Add headers: x-rapidapi-host: udemy-coupons-and-courses.p.rapidapi.com x-rapidapi-key: your copied API key Set content type to multipart/form-data. Add body parameter: page=1 (or as needed). Test API: Run the node to ensure the API responds with data successfully before continuing workflow setup. --- Use Cases & Benefits Automates daily updates of free Udemy courses in your sheet using the Udemy Coupons and Courses API on RapidAPI. Saves manual effort in tracking coupons and deals. Enables quick error alerts to maintain data accuracy. Ideal for course aggregators, affiliate marketers, or learning platforms needing fresh course data. --- Who This Workflow Is For Content curators and edtech platforms tracking free courses. Affiliate marketers promoting Udemy deals. Anyone needing real-time access to updated free Udemy coupons.

Sk developer By Sk developer
365

Daily Magento 2 customer sync to Google Contacts & Sheets without duplicates

Automatically sync newly registered Magento 2 customers to Google Contacts and Google Sheets every 24 hours — with full duplication control and seamless automation. This workflow is a plug-and-play customer contact automation system designed for Magento 2 store owners, marketers, and CRM teams. It fetches customer records registered within the last 24 hours (from 00:00:00 to 23:59:59), checks against an existing Google Sheet to avoid reprocessing, and syncs only the new ones into Google Contacts. This ensures your contact list is always fresh and up to date — without clutter or duplicates. ✅ What This Workflow Does: Automates Customer Syncing Every day, it fetches newly registered Magento 2 customers via API based on the exact date range (midnight to midnight). Deduplicates Using Google Sheets A master Google Sheet tracks already-synced emails. Before adding a customer, the workflow checks this list and skips if already present. Creates Google Contacts Automatically For each unique customer, it creates a new contact in your Google Contacts, saving fields like first name, last name, and email. Logs New Entries to Google Sheets In Google Sheets, it even records magento 2 customer group, createdat, websiteid & store_id After syncing, it adds each new email to the tracking sheet, building a cumulative record of synced contacts. Fully Scheduled & Automated Can be scheduled with the Cron node to run daily (e.g., 12:05 AM) with no manual intervention required. 🔧 Modules Used: HTTP Request (Magento 2 API) Date & Time (for filtering registrations) Google Sheets (for reading/writing synced emails) Google Contacts (for contact creation) Set, IF, and Merge nodes (for control logic) Cron (for scheduling the automation) 💼 Use Cases: Keep your email marketing tools synced with Magento 2 customer data. Build a CRM-friendly contact base in Google Contacts without duplicates. Share customer data with sales or support teams through synced Google Sheets. Reduce manual work and human error in data transfer processes. 🔒 Credentials Required Magento 2 Bearer Auth: Set up as a credential in n8n using your Magento 2 API access token. Google API 📂 Category E-commerce → Magento 2 (Adobe Commerce) 💬 Need Help? 💡 Having trouble setting it up or want to customize this workflow further? Feel free to reach out — I’m happy to help with setup, customization, or Magento 2 API integration issues. Contact: Author 👤 Author Kanaka Kishore Kandregula Certified Magento 2 Developer https://gravatar.com/kmyprojects https://www.linkedin.com/in/kanakakishore

Kanaka Kishore KandregulaBy Kanaka Kishore Kandregula
163