URL and IP lookups through Greynoise and VirusTotal

n8n template #1971

Summary

This n8n workflow serves as a powerful cybersecurity and threat intelligence tool to look up URLs or IP addresses through industry standard threat intelligence vendors. It starts with either a form submission or a webhook trigger, allowing users to input data, URLs or IPs that require analysis. The workflow then splits into two paths depending on whether the input data is an IP or URL. If an IP was given, it sets the ip variable to the IP; however if a URL was given the workflow will perform a DNS lookup using Google Public DNS and sets the ip variable based on the results from Google. The workflow then checks the obtained IP addresses against GreyNoise services, with one branch utilizing Gr

How to set it up

Open template #1971 on n8n.io and click Use for free, or copy the template JSON and paste it onto an empty canvas in n8n.
Create 2 credentials under Credentials → Add credential: Slack, Gmail. Then open each of those nodes and pick the credential.
Click Execute workflow and step through each node's output to confirm the data looks right.
Toggle the workflow to Active so its trigger runs on its own.

Hand off to your agent

Prompt

Help me set up the n8n workflow "URL and IP lookups through Greynoise and VirusTotal" (https://n8n.io/workflows/1971). It uses: HTTP Request, Slack, Gmail, Code. Import the template JSON into my n8n instance, list every credential I need to create, and walk me through testing it.

Paste into Claude Code and it will do the rest.

Apps and nodes

HTTP Request Slack Gmail Code

Questions

Yes. n8n Team published it free on n8n.io as a verified creator, and it has 8,572 views. It runs on n8n Cloud or a self-hosted n8n instance.

Slack, Gmail. The other 2 nodes are built into n8n.

Similar workflows

NameViews