{
  "name": "Check phishing URL reputation with VirusTotal and log to Google Sheets",
  "nodes": [
    {
      "id": "9f276b8f-a5f7-4ee9-9bdc-5de4df3071e1",
      "name": "Webhook - Submit URL for Analysis",
      "type": "n8n-nodes-base.webhook",
      "position": [
        -816,
        496
      ]
    },
    {
      "id": "d0dda112-56e7-42e5-82f6-50d074ca4523",
      "name": "Normalize Input URL",
      "type": "n8n-nodes-base.code",
      "position": [
        -624,
        496
      ]
    },
    {
      "id": "be6503df-d23c-4eda-98ad-ad6112faec0d",
      "name": "IF - URL is Valid?",
      "type": "n8n-nodes-base.if",
      "position": [
        -384,
        496
      ]
    },
    {
      "id": "35b3ab91-a3c1-460c-a5e2-ada7bbe610c3",
      "name": "Respond - Invalid URL error",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        -368,
        720
      ]
    },
    {
      "id": "1e01c712-1adb-4f25-9f19-f87dadae2594",
      "name": "VirusTotal - Submit URL for Scan",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        -64,
        480
      ]
    },
    {
      "id": "b62c79d8-e809-48ed-a83a-abc98038b1df",
      "name": "Wait - VirusTotal Scan Processing",
      "type": "n8n-nodes-base.wait",
      "position": [
        256,
        480
      ]
    },
    {
      "id": "c0f96217-dd5d-4cab-a4b2-353644158989",
      "name": "VirusTotal - Get Scan Analysis",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        432,
        480
      ]
    },
    {
      "id": "7dbe02af-08e2-4b45-83c2-f2b93d4e8d9d",
      "name": "IF - VirusTotal Analysis Completed?",
      "type": "n8n-nodes-base.if",
      "position": [
        688,
        512
      ]
    },
    {
      "id": "63c7b3f7-4730-452b-92d2-42c94592478e",
      "name": "Wait - Retry VT Analysis Poll",
      "type": "n8n-nodes-base.wait",
      "position": [
        256,
        704
      ]
    },
    {
      "id": "5a7f0141-9a96-469f-83fa-ccb2c998dfb1",
      "name": "Extract VirusTotal Verdict Stats",
      "type": "n8n-nodes-base.code",
      "position": [
        960,
        496
      ]
    },
    {
      "id": "2c15f50f-9139-4760-8a52-4f43c4b190c4",
      "name": "Build Phishing Verdict",
      "type": "n8n-nodes-base.code",
      "position": [
        1216,
        496
      ]
    },
    {
      "id": "7f4b09de-1bd0-4416-a086-59a108f3ffc3",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -880,
        304
      ],
      "parameters": {
        "width": 384,
        "height": 592,
        "content": "## URL Input & Normalization\nAccepts user URLs via webhook and ensures consistent formatting before security analysis.\n"
      }
    },
    {
      "id": "37658244-61f2-426f-8043-5517a224039c",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -480,
        304
      ],
      "parameters": {
        "width": 320,
        "height": 592,
        "content": "## Validation\nChecks for malformed or missing URLs and returns an error if validation fails.\n\n"
      }
    },
    {
      "id": "c9f716ab-354f-4d5d-93cf-eb72d636bba4",
      "name": "Sticky Note2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -144,
        304
      ],
      "parameters": {
        "width": 304,
        "height": 592,
        "content": "## Threat Intelligence Submission\nSubmits validated URLs to VirusTotal for multi-engine reputation scanning.\n"
      }
    },
    {
      "id": "d8672204-2303-4825-8326-f22944603ff2",
      "name": "Sticky Note3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        176,
        304
      ],
      "parameters": {
        "width": 688,
        "height": 1008,
        "content": "## Asynchronous Scan Handling\nPolls VirusTotal until the analysis is completed or retries reach the limit.\n"
      }
    },
    {
      "id": "fcebb1a2-d6e0-445d-9664-27de29b5dec8",
      "name": "Sticky Note4",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        880,
        336
      ],
      "parameters": {
        "width": null,
        "height": 384,
        "content": "## Detection Signal Extraction\nExtracts VirusTotal detection statistics used for phishing classification.\n"
      }
    },
    {
      "id": "60432bcf-0edc-4014-9651-6f7cd3fdc199",
      "name": "Sticky Note5",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1136,
        336
      ],
      "parameters": {
        "width": 256,
        "height": 384,
        "content": "## Phishing Decision Engine\nApplies threshold logic to classify URLs as SAFE, SUSPICIOUS, or PHISHING.\n"
      }
    },
    {
      "id": "6dd7cbd5-43c1-4a28-b0b2-331fc49900ec",
      "name": "Sticky Note6",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1408,
        336
      ],
      "parameters": {
        "width": 256,
        "height": 384,
        "content": "## Logging & Output\nStores scan results in Google Sheets for monitoring and incident tracking.\n\n "
      }
    },
    {
      "id": "c015ee89-b8fc-4853-8aaa-54cd4c779279",
      "name": "Respond - VT Service Error",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        800,
        64
      ]
    },
    {
      "id": "c6e341ff-f9bb-4b4c-a9e3-42537fb81edd",
      "name": "IF - VT Analysis Error?",
      "type": "n8n-nodes-base.if",
      "position": [
        576,
        144
      ]
    },
    {
      "id": "e9269973-2a40-42fc-bfac-77a571540389",
      "name": "IF - VT Submit Error?",
      "type": "n8n-nodes-base.if",
      "position": [
        112,
        128
      ]
    },
    {
      "id": "1ddd4032-8b2d-4033-9c7c-dcddf4079352",
      "name": "Log Scan Result",
      "type": "n8n-nodes-base.googleSheets",
      "position": [
        1488,
        496
      ]
    },
    {
      "id": "b6e9da2e-27a0-400a-8bce-d296a9a61752",
      "name": "Sticky Note7",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        32,
        -16
      ],
      "parameters": {
        "width": 944,
        "height": 304,
        "content": "## Error Handling & Resilience\nHandles VirusTotal API failures, validation errors, and timeout conditions to ensure reliable execution.\n"
      }
    },
    {
      "id": "162e190f-6e38-464d-9350-7fad93cf93c5",
      "name": "Increment Retry Counter",
      "type": "n8n-nodes-base.code",
      "position": [
        672,
        832
      ]
    },
    {
      "id": "6d76ed8e-d24d-4b30-9ce4-39c628ee0558",
      "name": "IF Max Retry Reached?",
      "type": "n8n-nodes-base.if",
      "position": [
        448,
        1088
      ]
    },
    {
      "id": "344723b0-aa1b-4584-b1c7-d5d26cb4f719",
      "name": "Respond Timeout",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        688,
        1072
      ]
    },
    {
      "id": "e0d9f480-2c11-4567-980c-1602d8c61198",
      "name": "Sticky Note8",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -1472,
        240
      ],
      "parameters": {
        "width": 560,
        "height": 704,
        "content": "## Phishing URL Reputation Checker\nThis workflow analyzes submitted URLs to determine whether they are phishing or malicious using VirusTotal’s threat intelligence data. It validates user input, submi"
      }
    }
  ],
  "connections": {
    "Log Scan Result": {
      "main": [
        []
      ]
    },
    "IF - URL is Valid?": {
      "main": [
        [
          {
            "node": "VirusTotal - Submit URL for Scan",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Respond - Invalid URL error",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Normalize Input URL": {
      "main": [
        [
          {
            "node": "IF - URL is Valid?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF - VT Submit Error?": {
      "main": [
        [
          {
            "node": "Respond - VT Service Error",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Wait - VirusTotal Scan Processing",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF Max Retry Reached?": {
      "main": [
        [
          {
            "node": "Respond Timeout",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Wait - Retry VT Analysis Poll",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Build Phishing Verdict": {
      "main": [
        [
          {
            "node": "Log Scan Result",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF - VT Analysis Error?": {
      "main": [
        [
          {
            "node": "Respond - VT Service Error",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "IF - VirusTotal Analysis Completed?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Increment Retry Counter": {
      "main": [
        [
          {
            "node": "IF Max Retry Reached?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Wait - Retry VT Analysis Poll": {
      "main": [
        [
          {
            "node": "VirusTotal - Get Scan Analysis",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "VirusTotal - Get Scan Analysis": {
      "main": [
        [
          {
            "node": "IF - VT Analysis Error?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Extract VirusTotal Verdict Stats": {
      "main": [
        [
          {
            "node": "Build Phishing Verdict",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "VirusTotal - Submit URL for Scan": {
      "main": [
        [
          {
            "node": "IF - VT Submit Error?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Wait - VirusTotal Scan Processing": {
      "main": [
        [
          {
            "node": "VirusTotal - Get Scan Analysis",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Webhook - Submit URL for Analysis": {
      "main": [
        [
          {
            "node": "Normalize Input URL",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF - VirusTotal Analysis Completed?": {
      "main": [
        [
          {
            "node": "Extract VirusTotal Verdict Stats",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Increment Retry Counter",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}