OpenRuna
Sign in
← Workflows

Phishing_analysis__URLScan_io_and_Virustotal_

23 nodes · manual, slack, splitInBatches, microsoftOutlook, httpRequest, schedule

Engine
n8n
Nodes
23
Trigger
scheduled/triggered
Source file
1600_Wait_Code_Automation_Scheduled.json

Workflow flow

IntegrationsManualSlackSplitInBatchesMicrosoftOutlookHTTPScheduleUrlScanIoFilterWaitCodeIFMerge
100%
TRIGGER

When clicking "Execute Workflow"

Manual

TRIGGER

Schedule Trigger

Schedule

Get all unread messages

MicrosoftOutlook

Mark as read

MicrosoftOutlook

VirusTotal: Get report

HTTP

Find indicators of compromise

Code

No error?

IF

Not empty?

Filter

sends slack message

Slack

Has URL?

IF

Wait 1 Minute

Wait

Merge Reports

Merge

Split In Batches

SplitInBatches

VirusTotal: Scan URL

HTTP

URLScan: Get report

UrlScanIo

URLScan: Scan URL

UrlScanIo

16 steps · flows top to bottom, branches left to right

Browse by integration

manualslacksplitInBatchesmicrosoftOutlookhttpRequestscheduleurlScanIofilterwait
Browse all integrations →
Download n8n JSONDownload sanitized JSONDownload flow graph

Import into n8n

  1. Download the n8n JSON file (full or sanitized).
  2. In n8n: Workflows → Import from file.
  3. Open each node and reconnect credentials to your accounts.
  4. Test with manual execution before enabling triggers.

Sanitized JSON removes credential IDs — safer for sharing. Flow graph JSON is OpenRuna's lightweight format for diagrams and other tools, not n8n import.

View source corpus ↗

Overview

Phishing_analysis__URLScan_io_and_Virustotal_ is a free n8n workflow on OpenRuna — 23 nodes connecting manual, slack, splitInBatches, microsoftOutlook, httpRequest, schedule, urlScanIo, filter. Download the JSON, view the flow diagram, and import it into your n8n instance.

What this workflow does

"Phishing_analysis__URLScan_io_and_Virustotal_" automates a manual-to-slack flow in n8n across 23 nodes. 23 nodes · manual, slack, splitInBatches, microsoftOutlook, httpRequest, schedule Execution begins at the scheduled/triggered trigger and flows through the 23 configured nodes. OpenRuna shows the full flow diagram, an integration breakdown, and a one-click JSON export for n8n's "Import from file". Use it to learn integration patterns, fork it for your own use case, or deploy it quickly after reconnecting credentials.

Use cases

  • Share it with your team as a documented reference for scheduled/triggered automations in the manual stack.
  • Study how data moves from manual to slack before building your own variant.
  • Use it as a starting template when wiring manual, slack, splitInBatches, microsoftOutlook, httpRequest, schedule, urlScanIo, filter — adjust node parameters to your accounts and record IDs.
  • Import "Phishing_analysis__URLScan_io_and_Virustotal_" into n8n, reconnect credentials for manual, slack, splitInBatches, microsoftOutlook, httpRequest, schedule, urlScanIo, filter, and run the same automation in your own workspace.

Example output

Imported into n8n, "Phishing_analysis__URLScan_io_and_Virustotal_" exposes 23 configured nodes. Trigger type: scheduled/triggered. Integrations: manual, slack, splitInBatches, microsoftOutlook, httpRequest, schedule, urlScanIo, filter. Reconnect the manual credential first, then walk the remaining nodes top to bottom. Run it once in test mode to verify any branch logic (Switch/IF nodes) before enabling production triggers.

Tips by platform

Claude

Paste the exported JSON for "Phishing_analysis__URLScan_io_and_Virustotal_" into Claude and ask it to explain each of the 23 nodes. Claude is good at suggesting credential mappings for manual, slack, splitInBatches, microsoftOutlook, httpRequest, schedule, urlScanIo, filter, plus error-handling and idempotency improvements before you run it in production.

ChatGPT

Have ChatGPT generate a checklist for adapting "Phishing_analysis__URLScan_io_and_Virustotal_" to your accounts — which manual, slack, splitInBatches, microsoftOutlook, httpRequest, schedule, urlScanIo, filter credentials to create and which node parameters to change first.

Cursor

Open the downloaded JSON in Cursor and use Agent mode to refactor hard-coded URLs into env vars, or to generate tests for any Code nodes. Keep the OpenRuna flow diagram open so you do not break connection order across the 23 nodes.

Frequently asked questions

How do I import "Phishing_analysis__URLScan_io_and_Virustotal_" into n8n?
Click Download n8n JSON on this page, then in n8n choose Workflows → Import from file and select the downloaded file. Reconnect credentials on each node — the export carries credential IDs from the original author's instance, not working secrets.
Which integrations does "Phishing_analysis__URLScan_io_and_Virustotal_" use?
It uses: manual, slack, splitInBatches, microsoftOutlook, httpRequest, schedule, urlScanIo, filter. The flow diagram above shows how each service connects across the 23 nodes. Filter OpenRuna by integration to find related workflows and tools.
Can I import a sanitized export without credentials?
Yes. Use "Download sanitized JSON" to strip credential references before sharing internally. You will still add your own manual and slack credentials in n8n after import.
What trigger type does "Phishing_analysis__URLScan_io_and_Virustotal_" use?
Trigger type: scheduled/triggered. After import, confirm the trigger node (webhook, schedule, or app event) matches your environment, then activate the workflow when you are ready to run it.
Is "Phishing_analysis__URLScan_io_and_Virustotal_" free to use?
OpenRuna catalogs community n8n workflows under open licenses. Check the source corpus link for the original license; commercial use may require verifying the third-party API terms for manual, slack, splitInBatches, microsoftOutlook, httpRequest, schedule, urlScanIo, filter.

Related resources