Scan Urls for Security Threats with Urlscan.io and Gpt-4o Mini

The workflow JSON

Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →

{
  "id": "hN9echP2rG1fuKXH",
  "meta": {
    "templateCredsSetupCompleted": true
  },
  "name": "AI-Powered Link Checker",
  "tags": [],
  "nodes": [
    {
      "id": "e04046ae-c8f8-42af-a55d-1197b7f0bca6",
      "name": "Sticky Note \u2014 How it works",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -624,
        16
      ],
      "parameters": {
        "color": 7,
        "width": 520,
        "height": 448,
        "content": "## How it works\n1. **Webhook** receives a POST with a `url`.\n2. **urlscan.io** submits the scan and returns an ID (UUID).\n3. **Wait (30s)** gives urlscan time to generate artifacts (e.g., screenshot).\n4. Your selected **ChatGPT** model will evaluate the results and provides a proper analysis to the recipient's email address. \n5. **Gmail** sends an email with links to the result page, screenshot, and API JSON.\n\n### Input example\n```json\n{ \"url\": \"https://example.com\" }\n```\n\n### Output\n- Result page link\n- Screenshot link (when ready)\n- API JSON link"
      },
      "typeVersion": 1
    },
    {
      "id": "89e7c181-f4ed-488e-8004-ec484cc1ff6b",
      "name": "Sticky Note \u2014 Setup",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -624,
        512
      ],
      "parameters": {
        "color": 4,
        "width": 520,
        "height": 360,
        "content": "## Setup & Credentials\n- Create **urlscan.io** API Key credential\n- Connect **ChatGPT model by supplying your OpenAPI  API Key**.\n- Connect **Gmail OAuth2**.\n- Set the **To** address in the Gmail node.\n\n### Webhook\n- Path: `/urlscan`\n- Test URL: `/webhook-test/urlscan`\n- Production URL: `/webhook/urlscan`\n\n### Notes\n- **Wait** is set to 30s; increase if screenshots aren't ready.\n- No hard-coded API keys in HTTP Request nodes (use n8n credentials).\n- Sticky Notes use **Markdown**."
      },
      "typeVersion": 1
    },
    {
      "id": "902d1e00-b848-4e9e-9691-643f618e73b0",
      "name": "Webhook",
      "type": "n8n-nodes-base.webhook",
      "position": [
        -32,
        288
      ],
      "parameters": {
        "path": "url-scan",
        "options": {},
        "httpMethod": "POST"
      },
      "typeVersion": 2
    },
    {
      "id": "a6ec0f94-a430-4508-b261-56cbac6f970b",
      "name": "Perform a scan",
      "type": "n8n-nodes-base.urlScanIo",
      "position": [
        192,
        288
      ],
      "parameters": {
        "url": "={{ $json.body.url[0] }}",
        "additionalFields": {}
      },
      "credentials": {
        "urlScanIoApi": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 1
    },
    {
      "id": "6b835da0-b0b8-4fd2-9a43-58d92e629e9c",
      "name": "Wait",
      "type": "n8n-nodes-base.wait",
      "position": [
        416,
        288
      ],
      "parameters": {
        "amount": 30
      },
      "typeVersion": 1.1
    },
    {
      "id": "948b41f1-5b09-4eeb-8427-b3970a4b826f",
      "name": "Send a message",
      "type": "n8n-nodes-base.gmail",
      "position": [
        1040,
        288
      ],
      "parameters": {
        "sendTo": "user@example.com",
        "message": "=<!-- \u2727 Sleek security notification \u2727 -->\n<h2 style=\"margin:0 0 12px 0;font:bold 18px Arial,Helvetica,sans-serif\">\n  URL submitted to <a href=\"https://urlscan.io\" style=\"color:#1a73e8;text-decoration:none\">urlscan.io</a>\n</h2>\n\n<table cellpadding=\"4\" cellspacing=\"0\" border=\"0\" style=\"font:14px/1.4 Arial,Helvetica,sans-serif\">\n  <tr>\n    <td><strong>URL:</strong></td>\n    <td>\n      <a href=\"{{ $('Webhook').item.json.body.url[0] }}\" style=\"color:#1a73e8\">\n        {{ $('Webhook').item.json.body.url[0] }}\n      </a>\n    </td>\n  </tr>\n  <tr>\n    <td><strong>Scan&nbsp;ID:</strong></td>\n    <td>{{ $('Perform a scan').item.json.scanId }}</td>\n  </tr>\n  <tr>\n    <td><strong>Classification:</strong></td>\n    <td>{{ JSON.parse($node[\"Message a model\"].json.message.content).classification }}</td>\n  </tr>\n  <tr>\n    <td><strong>Risk&nbsp;Score:</strong></td>\n    <td>{{ JSON.parse($node[\"Message a model\"].json.message.content).riskScore }}/10</td>\n  </tr>\n</table>\n\n<h3 style=\"margin:20px 0 6px 0;font:16px Arial,Helvetica,sans-serif\">AI&nbsp;Summary</h3>\n<p style=\"margin:0 0 18px 0;font:14px/1.5 Arial,Helvetica,sans-serif\">\n  {{ JSON.parse($node[\"Message a model\"].json.message.content).summary }}\n</p>\n\n<p style=\"margin:0 0 6px 0;font:14px/1.5 Arial,Helvetica,sans-serif\">\n  <strong>Screenshot (when ready):</strong><br>\n  <a href=\"https://urlscan.io/screenshots/{{ $('Perform a scan').item.json.scanId }}.png\" style=\"color:#1a73e8\">\n    https://urlscan.io/screenshots/{{ $('Perform a scan').item.json.scanId }}.png\n  </a>\n</p>\n\n<p style=\"margin:0;font:14px/1.5 Arial,Helvetica,sans-serif\">\n  <strong>Full result:</strong><br>\n  <a href=\"{{ $('Perform a scan').item.json.result }}\" style=\"color:#1a73e8\">\n    {{ $('Perform a scan').item.json.result }}\n  </a>\n</p>\n",
        "options": {
          "appendAttribution": false
        },
        "subject": "=URLScan Submitted for {{ $json.url || $item(0).$node[\"Webhook\"].json.body.url?.[0] || $item(0).$node[\"Webhook\"].json.body.url }}"
      },
      "credentials": {
        "gmailOAuth2": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 2.1
    },
    {
      "id": "07528213-cfc5-48e2-bacd-71cd1a24ae5f",
      "name": "Message a model",
      "type": "@n8n/n8n-nodes-langchain.openAi",
      "position": [
        624,
        288
      ],
      "parameters": {
        "modelId": {
          "__rl": true,
          "mode": "list",
          "value": "gpt-4.1-nano",
          "cachedResultName": "GPT-4.1-NANO"
        },
        "options": {},
        "messages": {
          "values": [
            {
              "content": "=You are a security analyst. \nGiven the following urlscan.io JSON result, do four things:\n\n1. Decide if the scan is malicious, suspicious or benign.\n2. Assign a risk score from 1-10 (10 = confirmed malicious).\n3. In two short sentences explain why.\n4. Output EXACTLY this JSON:\n   {\n     \"classification\": \"<malicious|suspicious|benign>\",\n     \"riskScore\": <integer>,\n     \"summary\": \"<two-sentence explanation>\"\n   }\n\nScan result:\n {{ $json.api }}  <-- (this references output of \u201cPerform a scan\u201d)\n\n\n"
            }
          ]
        }
      },
      "credentials": {
        "openAiApi": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 1.8
    }
  ],
  "active": false,
  "settings": {
    "executionOrder": "v1"
  },
  "versionId": "c2788927-e186-4ba0-a665-f1bf8db06cb0",
  "connections": {
    "Wait": {
      "main": [
        [
          {
            "node": "Message a model",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Webhook": {
      "main": [
        [
          {
            "node": "Perform a scan",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Perform a scan": {
      "main": [
        [
          {
            "node": "Wait",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Message a model": {
      "main": [
        [
          {
            "node": "Send a message",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Credentials you'll need

Each integration node will prompt for credentials when you import. We strip credential IDs before publishing — you'll add your own.

• gmailOAuth2
• openAiApi
• urlScanIoApi

About this workflow

• Webhook → urlscan.io → GPT-4o mini → Gmail • Payload example: • urlscan.io returns a Scan ID and raw JSON. • AI node classifies the scan as malicious / suspicious / benign, assigns a 1-10 risk score, and writes a two-sentence summary. • Gmail sends an alert that includes the…

Source: https://n8n.io/workflows/7159/ — original creator credit. Request a take-down →

More AI & RAG workflows → · Browse all categories →

Related workflows

Workflows that share integrations, category, or trigger type with this one. All free to copy and import.