{
  "name": "Analyze domain threats via Telegram with VirusTotal, AbuseCH, and Gemini AI",
  "nodes": [
    {
      "id": "008c04f8-b697-4416-8feb-600bc4e0b294",
      "name": "VirusTotal HTTP Request",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        -480,
        240
      ]
    },
    {
      "id": "5663e1e8-9028-4fcf-8b0b-ca3d0d57302c",
      "name": "Abuse.CH_URLHaus request",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        -480,
        -64
      ]
    },
    {
      "id": "353f2ad4-31f6-4556-a03d-7e503069ef61",
      "name": "Abuse.CH_ThreatFox request",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        -480,
        -400
      ]
    },
    {
      "id": "0092afcb-b18b-47a8-abc7-f92d9483b209",
      "name": "Telegram Trigger",
      "type": "n8n-nodes-base.telegramTrigger",
      "position": [
        -736,
        -64
      ]
    },
    {
      "id": "ed0b3323-bf4b-4185-95b3-f9db923bde85",
      "name": "Send a text message",
      "type": "n8n-nodes-base.telegram",
      "position": [
        736,
        -64
      ]
    },
    {
      "id": "c66766ef-853c-4e3b-8749-f77eadb0ccb0",
      "name": "Aggregate",
      "type": "n8n-nodes-base.aggregate",
      "position": [
        192,
        -64
      ]
    },
    {
      "id": "b24e11d8-e333-4a19-9faa-1c403c26c354",
      "name": "Message a model",
      "type": "@n8n/n8n-nodes-langchain.googleGemini",
      "position": [
        384,
        -64
      ]
    },
    {
      "id": "1fb7cacc-698d-4eb9-91b1-7ff96520cb45",
      "name": "Merge",
      "type": "n8n-nodes-base.merge",
      "position": [
        32,
        -80
      ]
    },
    {
      "id": "9bff600c-39c9-41af-83e3-26c8435daac4",
      "name": "Edit Field - ThreatFox",
      "type": "n8n-nodes-base.set",
      "position": [
        -176,
        -400
      ]
    },
    {
      "id": "3395ff9b-966c-4e92-88f0-f0117ca1e095",
      "name": "Edit Field - URLHaus",
      "type": "n8n-nodes-base.set",
      "position": [
        -176,
        -64
      ]
    },
    {
      "id": "c74f5164-6842-48e5-b145-162906a6f8ed",
      "name": "Edit Field - VirusTotal",
      "type": "n8n-nodes-base.set",
      "position": [
        -176,
        240
      ]
    },
    {
      "id": "f2959d41-6041-4617-8285-0dda0b5a28e7",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -1376,
        -624
      ],
      "parameters": {
        "width": 496,
        "height": 960,
        "content": "## Description:\nThis n8n workflow enables Telegram users to submit a domain for quick threat intelligence analysis. It queries VirusTotal, AbuseCH URLHaus, and AbuseCH ThreatFox, then uses Gemini AI t"
      }
    },
    {
      "id": "a661a875-bb09-43e3-9ccb-65cb73d42a18",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -832,
        -624
      ],
      "parameters": {
        "width": 256,
        "height": 1120,
        "content": "## Trigger Telegram Message:\n*  Set your Telegram credentials (Token) \n* Restrict to your User ID or specific Chat ID (node settings additional fields) to prevent unauthorized access and responses to "
      }
    },
    {
      "id": "22253b36-1310-4e63-92fc-86020afd8ec7",
      "name": "Sticky Note2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -560,
        -624
      ],
      "parameters": {
        "width": 288,
        "height": 1120,
        "content": "## Api requests:\n* Set your APIKey (Virustotal URLhaus and ThreatFox)\n"
      }
    },
    {
      "id": "53cddb4e-361e-443f-865d-0bf219deed29",
      "name": "Sticky Note3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -256,
        -624
      ],
      "parameters": {
        "width": 576,
        "height": 1120,
        "content": "## Data Structuring\nPrepering the data into single structured payload for the AI model."
      }
    },
    {
      "id": "7c2a7506-b488-4c61-9c2a-efbf63e3fe7c",
      "name": "Sticky Note4",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        336,
        -624
      ],
      "parameters": {
        "width": 336,
        "height": 1120,
        "content": "## Ai Model Analysis\nGemini - tested with Gemini 3 Flash\nThere are 2 different prompts included, User and System prompt.\n* Set your APIKey\n"
      }
    },
    {
      "id": "aecdad28-e560-4d25-9591-12e00ac6a448",
      "name": "Sticky Note5",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        688,
        -624
      ],
      "parameters": {
        "width": 272,
        "height": 1120,
        "content": "## Telegram Report Delivery \n\n"
      }
    }
  ],
  "connections": {
    "Merge": {
      "main": [
        [
          {
            "node": "Aggregate",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Aggregate": {
      "main": [
        [
          {
            "node": "Message a model",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Message a model": {
      "main": [
        [
          {
            "node": "Send a text message",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Telegram Trigger": {
      "main": [
        [
          {
            "node": "Abuse.CH_ThreatFox request",
            "type": "main",
            "index": 0
          },
          {
            "node": "Abuse.CH_URLHaus request",
            "type": "main",
            "index": 0
          },
          {
            "node": "VirusTotal HTTP Request",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Edit Field - URLHaus": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Edit Field - ThreatFox": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 2
          }
        ]
      ]
    },
    "Edit Field - VirusTotal": {
      "main": [
        [
          {
            "node": "Merge",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "VirusTotal HTTP Request": {
      "main": [
        [
          {
            "node": "Edit Field - VirusTotal",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Abuse.CH_URLHaus request": {
      "main": [
        [
          {
            "node": "Edit Field - URLHaus",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Abuse.CH_ThreatFox request": {
      "main": [
        [
          {
            "node": "Edit Field - ThreatFox",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}