# URL and IP lookups with Greynoise and VirusTotal: n8n workflow

> Started by someone submitting a form, and works across Gmail and Slack. 23 steps, 2 branches, 1 loop or waits: large, and worth reading before you trust it...

Source: https://millionrounds.com/workflow/url-and-ip-lookups-with-greynoise-and-virustotal (Millionrounds; every figure on the page links to its filing or article)

[Automation library](https://millionrounds.com/workflows) · [Alerts and monitoring](https://millionrounds.com/workflows?category=Alerts+and+monitoring#library)

# URL and IP lookups with Greynoise and VirusTotal

Started by someone submitting a form, and works across Gmail and Slack. 23 steps, 2 branches, 1 loop or waits: large, and worth reading before you trust it with anything live.

Large

[Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Furl-and-ip-lookups-with-greynoise-and-virustotal)

**23 steps** Large: read it before trusting it with anything live

**2** Branches: places the flow splits

**1** Loop or waits

**2** Services it connects to

## The flow

Starts it 2 Logic 14 Service 7

The steps in the order they run, from what starts it.

- 1 **Webhook** Webhook *Starts it*
- 2 **Form Trigger** Form trigger *Starts it*
- 3 **Get List of URLs** Item Lists *Logic*
- 4 **Is IP?** If *Logic*
- 5 **Set Email** Set *Logic*
- 6 **Set IP** Set *Logic*
- 7 **DNS Lookup** Http Request *Service*
- 8 **Merge** Merge *Logic*
- 9 **Set IP From Lookup** Code *Logic*
- 10 **Start VirusTotal Scan** Http Request *Service*
- 11 **GreyNoise IP Check** Http Request *Service*
- 12 **GreyNoise RIOT lookup** Http Request *Service*
- 13 **Wait 5s** Wait *Logic*
- 14 **Merge Greynoise results** Merge *Logic*
- 15 **VirusTotal result** Http Request *Service*
- 16 **Greynoise Summary** Set *Logic*
- 17 **Filter** Filter *Logic*
- 18 **Merge VirusTotal & Greynoise results** Merge *Logic*
- 19 **VirusTotal ready?** If *Logic*
- 20 **Send Report Slack** Slack *Service*
- 21 **Send Report Email** Gmail *Service*
- 22 **Combine looped items** Code *Logic*
- 23 **VirusTotal Summary** Set *Logic*

## How it's built

- **Starts on:** Someone submitting a form
- **Steps:** 23, with 2 branches, 1 loop or waits
- **Size:** Large: read it before trusting it with anything live
- **Connects to:** Gmail, Slack
- **Model:** None. This is plumbing, not judgement

## Questions

What does it need to run?

An n8n account, plus your own Gmail and Slack accounts. You connect your own accounts after importing it; none are included.

What starts it?

It starts on someone submitting a form.

Does it use AI?

No. Every step is fixed logic or a call to a service, so it does the same thing every time.

How long does it take to set up?

Take your time. At 23 steps it is large: read it before trusting it with anything live.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

**Before you run it**

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 23 steps before you point it at anything that matters.

## Run it in n8n

- **Create your n8n account** Free to start. n8n is where the workflow runs. [Create an n8n account ↗](https://millionrounds.com/n8n)
- **Download the workflow** Free with a Millionrounds account. [Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Furl-and-ip-lookups-with-greynoise-and-virustotal)
- **Paste it into n8n** Open a new workflow in n8n and paste. Then connect your own accounts.

Stored with the author's traces removed: canvas notes, instance identifiers, saved credential names and any live document they had left behind.

## Connects to

Each opens the other workflows that use it.

[Gmail](https://millionrounds.com/workflows?service=Gmail#library)[Slack](https://millionrounds.com/workflows?service=Slack#library)

## Workflows like it

Also alerts and monitoring, with the same services where possible, closest in size first.

- [**Analyze contract risk from PDFs with OpenAI and Supabase** 23 steps · Gmail, Slack](https://millionrounds.com/workflow/analyze-contract-risk-from-pdfs-with-openai-and-supabase)
- [**Back up your n8n workflows to GitHub with Slack** 23 steps · GitHub, Slack](https://millionrounds.com/workflow/back-up-your-n8n-workflows-to-github-with-slack)
- [**Build an event-driven pub/sub bus with HTTP and Slack** 23 steps · Slack](https://millionrounds.com/workflow/build-an-event-driven-pub-sub-bus-with-http-and-slack)
- [**Monitor customer risk and AI feedback with PostgreSQL** 23 steps · Discord, Gmail](https://millionrounds.com/workflow/monitor-customer-risk-and-ai-feedback-with-postgresql)
- [**User authentication system with Gmail and Postgres** 23 steps · Gmail, Postgres](https://millionrounds.com/workflow/user-authentication-system-with-gmail-and-postgres)
- [**Automate Reddit replies with F5Bot and OpenAI** 23 steps · calls a model · Gmail, Google Sheets](https://millionrounds.com/workflow/automate-reddit-replies-with-f5bot-and-openai)