URL and IP lookups through Greynoise and VirusTotal

Needs changes

by n8n Team ✓ · 9,972 views · created 2023-11-07 · SecOps

Needs changes. This template uses 1 thing(s) that n8n 3.0 removes: Item Lists (legacy). 1 breaking item(s) found. Static check, last run 2026-10-19.

What this workflow does

This workflow has 23 nodes and runs when someone submits an n8n form (“Scan URL or IP and get a report”) (plus 1 other trigger). Along the way it connects Slack and Gmail. It also calls virustotal.com over HTTP.

How it runs

Trigger: When someone submits an n8n form (“Scan URL or IP and get a report”) (plus 1 other trigger).

Is IP? (If): checks a condition and branches into true / false
Get List of URLs (Item Lists): reshapes item lists (legacy Item Lists node)
Set IP (Edit Fields (Set)): sets or maps fields
DNS Lookup (HTTP Request): calls an HTTP API
Set Email (Edit Fields (Set)): sets or maps fields
Merge: merges the data from its input branches
Set IP From Lookup (Code): runs custom JavaScript code
Start VirusTotal Scan (HTTP Request): calls virustotal.com (POST)
GreyNoise IP Check (HTTP Request): calls an HTTP API
GreyNoise RIOT lookup (HTTP Request): calls an HTTP API

…plus 11 more steps. See the full node list below.

Services it uses

Slack Gmail

HTTP calls to: virustotal.com

Before you upgrade to n8n 3.0

1 thing in this workflow is removed in n8n 3.0. Fix it before you upgrade:

Item Lists (legacy) in Get List of URLs: replace with Split Out, Aggregate, Sort, Limit, Remove Duplicates or Summarize (match the operation used).

Rather not rewrite it? Many of these flows can be rebuilt in Make (free plan).

Removed in 3.0	Replace with
Item Lists (legacy) Get List of URLs	Split Out, Aggregate, Sort, Limit, Remove Duplicates or Summarize (match the operation used)

Nodes used (12)

HTTP Requestn8n-nodes-base.httpRequest
Coden8n-nodes-base.code
Edit Fields (Set)n8n-nodes-base.set
Mergen8n-nodes-base.merge
Ifn8n-nodes-base.if
Waitn8n-nodes-base.wait
Webhookn8n-nodes-base.webhook
Item Listsn8n-nodes-base.itemLists
Slackn8n-nodes-base.slack
Gmailn8n-nodes-base.gmail
Filtern8n-nodes-base.filter
n8n Form Triggern8n-nodes-base.formTrigger

From the author

This n8n workflow serves as a powerful cybersecurity and threat intelligence tool to look up URLs or IP addresses through industry standard threat intelligence vendors. It starts with either a form submission or a webhook trigger, allowing users to input…
Excerpt from n8n Team's description on n8n.io.

View the original on n8n.io → Check your own copy

URL and IP lookups through Greynoise and VirusTotal

What this workflow does

How it runs

Services it uses

Before you upgrade to n8n 3.0

Nodes used (12)

From the author

Get the weekly “what broke” email