Automation library · Data collection

Check phishing URL reputation with VirusTotal

Started by another system calling it, and works across Google Sheets. 18 steps, 5 branches, 2 loops or waits: a working afternoon to understand properly.

Medium

Download free
18 stepsMedium: a working afternoon
5Branches: places the flow splits
2Loops or waits
1Service it connects to

The flow

Starts it 4Logic 11Service 3

The steps in the order they run, from what starts it.

  1. 1Webhook - Submit URL for AnalysisWebhookStarts it
  2. 2Normalize Input URLCodeLogic
  3. 3IF - URL is Valid?IfLogic
  4. 4VirusTotal - Submit URL for ScanHttp RequestService
  5. 5Respond - Invalid URL errorRespond To WebhookStarts it
  6. 6IF - VT Submit Error?IfLogic
  7. 7Respond - VT Service ErrorRespond To WebhookStarts it
  8. 8Wait - VirusTotal Scan ProcessingWaitLogic
  9. 9VirusTotal - Get Scan AnalysisHttp RequestService
  10. 10IF - VT Analysis Error?IfLogic
  11. 11IF - VirusTotal Analysis Completed?IfLogic
  12. 12Extract VirusTotal Verdict StatsCodeLogic
  13. 13Increment Retry CounterCodeLogic
  14. 14Build Phishing VerdictCodeLogic
  15. 15IF Max Retry Reached?IfLogic
  16. 16Log Scan ResultGoogle SheetsService
  17. 17Respond TimeoutRespond To WebhookStarts it
  18. 18Wait - Retry VT Analysis PollWaitLogic

How it's built

Starts on
Another system calling it
Steps
18, with 5 branches, 2 loops or waits
Size
Medium: a working afternoon
Connects to
Google Sheets
Model
None. This is plumbing, not judgement

Questions

What does it need to run?

An n8n account, plus your own Google Sheets account. You connect your own accounts after importing it; none are included.

What starts it?

It starts on another system calling it.

Does it use AI?

No. Every step is fixed logic or a call to a service, so it does the same thing every time.

How long does it take to set up?

Plan an afternoon. 18 steps is enough that you should read each one before running it.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

Before you run it

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 18 steps before you point it at anything that matters.