Phishing Analysis - URLScan.io and VirusTotal

n8n template #1992

Summary

This n8n workflow automates the analysis of email messages received in a Microsoft Outlook inbox to identify indicators of compromise (IOCs), specifically suspicious URLs. It can be triggered manually or scheduled to run daily at midnight. The workflow begins by retrieving up to 100 read email messages from the Outlook inbox. However, there seems to be a configuration issue as it should retrieve unread messages, not read ones. It then marks these messages as read to avoid processing them again in the future. The messages are then split into individual items using the Split In Batches node for sequential processing. For each email, the workflow analyzes its content to find URLs, which are con

How to set it up

Open template #1992 on n8n.io and click Use for free, or copy the template JSON and paste it onto an empty canvas in n8n.
Create 3 credentials under Credentials → Add credential: Slack, Microsoft Outlook, urlscan.io. Then open each of those nodes and pick the credential.
Click Execute workflow and step through each node's output to confirm the data looks right.
Toggle the workflow to Active so its trigger runs on its own.

Hand off to your agent

Prompt

Help me set up the n8n workflow "Phishing Analysis - URLScan.io and VirusTotal" (https://n8n.io/workflows/1992). It uses: HTTP Request, Slack, Microsoft Outlook, urlscan.io, Code. Import the template JSON into my n8n instance, list every credential I need to create, and walk me through testing it.

Paste into Claude Code and it will do the rest.

Apps and nodes

HTTP Request Slack Microsoft Outlookurlscan.ioCode

Questions

Yes. n8n Team published it free on n8n.io as a verified creator, and it has 27K views. It runs on n8n Cloud or a self-hosted n8n instance.

Slack, Microsoft Outlook, urlscan.io. The other 2 nodes are built into n8n.

Similar workflows

NameViews