Monitor Domains & Ips on Abuseipdb Blacklist with Slack Alerts

The workflow JSON

Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →

{
  "id": "DlmtdnHx6mOhXjok",
  "meta": {
    "templateCredsSetupCompleted": true
  },
  "name": "Automated Domain/IP Blacklist Monitor with Slack",
  "tags": [],
  "nodes": [
    {
      "id": "d27bbd40-6b95-422c-8312-4e3a4b861497",
      "name": "Scheduled Check",
      "type": "n8n-nodes-base.scheduleTrigger",
      "position": [
        0,
        0
      ],
      "parameters": {
        "rule": {
          "interval": [
            {}
          ]
        }
      },
      "typeVersion": 1.2
    },
    {
      "id": "b4c57e0b-be8a-4e60-a5ef-99ef2fff399e",
      "name": "Define Domains/IPs",
      "type": "n8n-nodes-base.code",
      "position": [
        224,
        0
      ],
      "parameters": {
        "jsCode": "const assetsToCheck = [\n    \"your-company.com\",\n    \"mail.your-company.com\",\n    \"0.0.0.0\" // Example public IP\n];\n\nreturn assetsToCheck.map(asset => ({\n    json: { asset: asset }\n}));"
      },
      "typeVersion": 2
    },
    {
      "id": "67a1c4d1-4a3f-48a9-a923-9bfa00a86014",
      "name": "Query Blacklist API",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        448,
        0
      ],
      "parameters": {
        "url": "=https://api.abuseipdb.com/api/v2/check?ipAddress={{ $json.asset }} ",
        "options": {}
      },
      "typeVersion": 4.2
    },
    {
      "id": "7a5ba1a0-efdf-4398-a489-a9fdfdfbc8ff",
      "name": "Is on Blacklist?",
      "type": "n8n-nodes-base.if",
      "position": [
        672,
        0
      ],
      "parameters": {
        "options": {},
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "30182fcb-5f61-460c-a444-c1e1feecc245",
              "operator": {
                "type": "number",
                "operation": "gt"
              },
              "leftValue": "={{ $json.abuseConfidenceScore }}",
              "rightValue": 50
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "b111cb69-17d7-42b7-8d45-6744e77209e9",
      "name": "Send High-Priority Alert",
      "type": "n8n-nodes-base.slack",
      "position": [
        896,
        0
      ],
      "parameters": {
        "text": "=\ud83d\udea8 *URGENT: Blacklist Alert!* \ud83d\udea8\\nAsset *{{ $json.asset }}* has a confidence score of *{{ $json.abuseConfidenceScore }}*. Immediate action is required!",
        "user": {
          "__rl": true,
          "mode": "id",
          "value": "123qa"
        },
        "select": "user",
        "otherOptions": {}
      },
      "credentials": {
        "slackApi": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 2.3
    },
    {
      "id": "5c802353-4127-461d-88f3-bd58d55bb118",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -48,
        -80
      ],
      "parameters": {
        "width": 1152,
        "height": 272,
        "content": "## Flow"
      },
      "typeVersion": 1
    },
    {
      "id": "306508a4-bdbc-449f-83c5-c61173df78c7",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -48,
        224
      ],
      "parameters": {
        "color": 3,
        "width": 1152,
        "height": 1680,
        "content": "# Automated Domain/IP Blacklist Monitor\n\n## \ud83d\udcdd Problem\n\n*The core problem we're solving:** Our email deliverability and sender reputation are at risk if our domain or IP addresses are listed on spam blacklists. Manual, ad-hoc checks are inefficient and often reactive, meaning we only discover a problem after emails are already bouncing or being marked as spam. This can lead to a loss of customer trust and business.\n\n---\n\n## \u2705 Solution\n\n*How this workflow addresses the problem:** This automated workflow proactively monitors our key domains and IP addresses against major blacklists. It will automatically check for new listings on a set schedule and send immediate alerts to the appropriate team members if a blacklisting is detected. This allows us to react quickly, identify the root cause, and initiate the delisting process before our reputation is severely impacted.\n\n---\n\n## \ud83d\udc65 For Whom\n\n**Who will use this system:**\n* *System Administrators:** To monitor the health of our email servers and network infrastructure.\n* *Marketing Team:** To ensure email campaigns reach their audience and maintain a high sender reputation.\n* *Security Team:** To quickly identify potential compromised systems or malicious activity on our network that could be causing the blacklisting.\n* *IT Support:** To respond to support tickets from customers about email delivery issues.\n\n---\n\n## \ud83c\udf10 Scope\n\n**What is included:**\n* Automatic, scheduled checks of all specified domains and IP addresses against a list of major blacklists (e.g., Spamhaus, Barracuda, SpamCop).\n* Real-time notifications (e.g., via email, Slack, or a ticket system) upon detection of a blacklisting event.\n* A centralized dashboard or log for viewing the status of all monitored assets.\n\n**What is out of scope:**\n* *Automatic delisting:** This workflow does not automatically request delisting. Delisting requires a manual investigation to address the underlying problem and a formal request to the blacklist provider.\n* *Root cause analysis:** The system will not automatically determine why an IP or domain was blacklisted. This requires human investigation.\n* *Internal mail server log analysis:** While the monitor can point to a problem, it does not analyze internal email logs to find the source of the spam.\n\n---\n\n## \ud83d\udee0\ufe0f How to Set Up\n\nFollow these steps to set up the automated blacklist monitor:\n\n1.  **Choose a Monitoring Service:** Select a reliable blacklist monitoring service (e.g., HetrixTools, MXToolBox, or a similar platform).\n2.  **Create an Account:** Sign up for the service and set up your organization's account.\n3.  **Add Monitored Assets:**\n    * Navigate to the \"Monitors\" or \"Assets\" section.\n    * Add each of our core domains (e.g., `ourcompany.com`) and all relevant outbound mail server IP addresses.\n4.  **Configure Notifications:**\n    * Set up notification channels for alerts. This could be an email to `security@ourcompany.com` or a dedicated Slack channel (`#blacklist-alerts`).\n    * Customize the notification frequency and details to ensure the alerts are actionable.\n5.  **Review the Dashboard:** Familiarize yourself with the system's dashboard. This will be your central point for reviewing the status of all monitored assets and viewing historical data.\n6.  **Set an Action Plan:** Document the steps to take when an alert is received, including:\n    * Immediately notifying the security and IT teams.\n    * Opening an incident ticket.\n    * Beginning the root cause analysis.\n    * Documenting the delisting process."
      },
      "typeVersion": 1
    }
  ],
  "active": false,
  "settings": {
    "executionOrder": "v1"
  },
  "versionId": "973431a8-144d-44ca-b031-eea4794565a3",
  "connections": {
    "Scheduled Check": {
      "main": [
        [
          {
            "node": "Define Domains/IPs",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Is on Blacklist?": {
      "main": [
        [
          {
            "node": "Send High-Priority Alert",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Define Domains/IPs": {
      "main": [
        [
          {
            "node": "Query Blacklist API",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query Blacklist API": {
      "main": [
        [
          {
            "node": "Is on Blacklist?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Credentials you'll need

Each integration node will prompt for credentials when you import. We strip credential IDs before publishing — you'll add your own.

• slackApi

About this workflow

The automated blacklist monitor is designed to be a proactive, not reactive, tool. Here is the high-level process: Scheduled Checks: At regular intervals (e.g., every 30 minutes or every hour), a monitoring script or service sends a request to a list of predefined DNS blacklists…

Source: https://n8n.io/workflows/6836/ — original creator credit. Request a take-down →

More Slack & Telegram workflows → · Browse all categories →

Related workflows

Workflows that share integrations, category, or trigger type with this one. All free to copy and import.