{ "edges": [ { "to": "c66766ef-853c-4e3b-8749-f77eadb0ccb0", "from": "1fb7cacc-698d-4eb9-91b1-7ff96520cb45", "toPort": "0", "fromPort": "0" }, { "to": "b24e11d8-e333-4a19-9faa-1c403c26c354", "from": "c66766ef-853c-4e3b-8749-f77eadb0ccb0", "toPort": "0", "fromPort": "0" }, { "to": "ed0b3323-bf4b-4185-95b3-f9db923bde85", "from": "b24e11d8-e333-4a19-9faa-1c403c26c354", "toPort": "0", "fromPort": "0" }, { "to": "353f2ad4-31f6-4556-a03d-7e503069ef61", "from": "0092afcb-b18b-47a8-abc7-f92d9483b209", "toPort": "0", "fromPort": "0" }, { "to": "5663e1e8-9028-4fcf-8b0b-ca3d0d57302c", "from": "0092afcb-b18b-47a8-abc7-f92d9483b209", "toPort": "0", "fromPort": "0" }, { "to": "008c04f8-b697-4416-8feb-600bc4e0b294", "from": "0092afcb-b18b-47a8-abc7-f92d9483b209", "toPort": "0", "fromPort": "0" }, { "to": "1fb7cacc-698d-4eb9-91b1-7ff96520cb45", "from": "3395ff9b-966c-4e92-88f0-f0117ca1e095", "toPort": "1", "fromPort": "0" }, { "to": "1fb7cacc-698d-4eb9-91b1-7ff96520cb45", "from": "9bff600c-39c9-41af-83e3-26c8435daac4", "toPort": "2", "fromPort": "0" }, { "to": "1fb7cacc-698d-4eb9-91b1-7ff96520cb45", "from": "c74f5164-6842-48e5-b145-162906a6f8ed", "toPort": "0", "fromPort": "0" }, { "to": "c74f5164-6842-48e5-b145-162906a6f8ed", "from": "008c04f8-b697-4416-8feb-600bc4e0b294", "toPort": "0", "fromPort": "0" }, { "to": "3395ff9b-966c-4e92-88f0-f0117ca1e095", "from": "5663e1e8-9028-4fcf-8b0b-ca3d0d57302c", "toPort": "0", "fromPort": "0" }, { "to": "9bff600c-39c9-41af-83e3-26c8435daac4", "from": "353f2ad4-31f6-4556-a03d-7e503069ef61", "toPort": "0", "fromPort": "0" } ], "nodes": [ { "id": "008c04f8-b697-4416-8feb-600bc4e0b294", "name": "VirusTotal HTTP Request", "type": "http", "params": { "": "", "url": "=https://www.virustotal.com/api/v3/domains/{{ $json.message.text }}", "method": "GET", "options": {}, "sendBody": false, "sendQuery": false, "curlImport": "", "infoMessage": "", "sendHeaders": false, "authentication": "predefinedCredentialType", "httpVariantWarning": "", "nodeCredentialType": "virusTotalApi", "provideSslCertificates": false }, "position": [ -480, 240 ] }, { "id": "5663e1e8-9028-4fcf-8b0b-ca3d0d57302c", "name": "Abuse.CH_URLHaus request", "type": "http", "params": { "url": "https://urlhaus-api.abuse.ch/v1/host/", "method": "POST", "options": {}, "sendBody": true, "contentType": "form-urlencoded", "authentication": "genericCredentialType", "bodyParameters": { "parameters": [ { "name": "host", "value": "={{ $json.message.text }}" } ] }, "genericAuthType": "httpHeaderAuth" }, "position": [ -480, -64 ] }, { "id": "353f2ad4-31f6-4556-a03d-7e503069ef61", "name": "Abuse.CH_ThreatFox request", "type": "http", "params": { "url": "https://threatfox-api.abuse.ch/api/v1/", "method": "POST", "options": {}, "sendBody": true, "authentication": "genericCredentialType", "bodyParameters": { "parameters": [ { "name": "query", "value": "search_ioc" }, { "name": "search_term", "value": "={{ $json.message.text }}" } ] }, "genericAuthType": "httpHeaderAuth" }, "position": [ -480, -400 ] }, { "id": "0092afcb-b18b-47a8-abc7-f92d9483b209", "name": "Telegram Trigger", "type": "trigger", "params": { "kind": "n8n-nodes-base.telegramTrigger", "updates": [ "message" ], "additionalFields": { "chatIds": "" } }, "position": [ -736, -64 ] }, { "id": "ed0b3323-bf4b-4185-95b3-f9db923bde85", "name": "Send a text message", "type": "integration", "params": { "text": "={{ $json.candidates[0].content.parts[0].text }}", "chatId": "={{ $('Telegram Trigger').item.json.message.chat.id }}", "service": "telegram", "operation": "read", "additionalFields": { "parse_mode": "HTML" } }, "position": [ 736, -64 ] }, { "id": "c66766ef-853c-4e3b-8749-f77eadb0ccb0", "name": "Aggregate", "type": "passthrough", "params": { "mode": "aggregate", "options": {}, "aggregate": "aggregateAllItemData" }, "position": [ 192, -64 ] }, { "id": "b24e11d8-e333-4a19-9faa-1c403c26c354", "name": "Message a model", "type": "llm", "params": { "modelId": { "__rl": true, "mode": "list", "value": "models/gemini-3-flash-preview", "cachedResultName": "models/gemini-3-flash-preview" }, "options": { "systemMessage": "You are an experienced Cybersecurity Analyst Assistant\nYour Role:\nAnalyze and summarize domain scan results from the following sources: VirusTotal, AbuseCH URLhaus, and AbuseCH ThreatFox.\nCommunicate your findings in professional, concise, and clear language suitable for technical security reporting.\nIdentify, emphasize, and extract key insights from each scan result, such as threat indicators, detection consistency, malicious activity patterns, or reputation data.\nAccount for the possibility of false positives. For example, a suspicious subdomain hosted under a legitimate parent (e.g., on cloud providers or hosting platforms) might not indicate the entire domain is malicious. \nIf possible, differentiate between malicious use of a service and a compromised or abused legitimate domain\nMaintain a neutral, evidence based tone, avoid assumptions not supported by the data.\nAvoid using absolute or emotional terms such as definitely, certainly, overwhelmingly, clearly malicious, or without doubt.\nUse probabilistic and evidence-based phrasing instead, such as likely, possibly, appears to, or based on available data.\nUse terminology appropriate for SOC or threat intelligence reporting.\nDo not include raw data unless explicitly requested." }, "messages": { "values": [ { "content": "=Analyze the data you receive from VirusTotal, URLHaus, and ThreatFox based on these instructions:\n\nAnalysis Instructions:\n1. Identify the scanned URL: {{ $('Telegram Trigger').item.json.message.text }}\n2. Inside the array data, you will find 3 items representing scan results from VirusTotal, Abuse.CH URLHaus or Abuse.CH ThreatFox, U can understand which one is it by the sourceNode field in each data item\n3. Actual data of each item included in {{ $json.data[0]['DataSummary'] }} for {{ $json.data[0].sourceNode }}, {{ $json.data[1]['DataSummary'] }} for {{ $json.data[1].sourceNode }}, {{ $json.data[2]['DataSummary'] }} {{ $json.data[2].sourceNode }}\n4. Key data points to analyze :\n* VirusTotal, number of Malicious, Suspicious and Harmless verdicts under the different engines, u can use the last_analysis_stats and include the numbers for each one.\n* URLHaus blacklists, url_count and different threatTypes for urls\n* ThreatFox threat_type,Threat_type_desc and tags.\n* Domain creation date (new domains = higher risk, update dates are not so indicative)\n\nAssessment:\nCreate a short domain assessment based on the Analysis Instructions you received\n* make it clear, short and simple\n* include in the end your verdict (Malicious, Suspicious, Benign, Legit)\n\nOutput Format:\nTelegram bot output using ONLY: bold, underline, italic\nSingle \\n between lines, double \\n\\n between sections. Max 90 chars/line.\nFor all domain you present, use defanging, replace . with [.] \n\n**Required structure:**\n1. Domain: {{ $('Telegram Trigger').item.json.message.text }} \n2. Scan Time: {{ $now }}\n2. Findings: 3 bullets (one per sourceNode value, include the sourceNode value and the related findings in new line with /n, note \"no results\" if empty)\n3. Assessment: 5-7 neutral lines + verdict\n4. Recommendations: Max 3 bullets\n5. Close with this reminder: Better safe than sorry, check before you click and remember \"In God We Trust, All Others We Investigate...\"" } ] }, "provider": "google", "simplify": false, "builtInTools": {}, "systemMessage": "You are an experienced Cybersecurity Analyst Assistant\nYour Role:\nAnalyze and summarize domain scan results from the following sources: VirusTotal, AbuseCH URLhaus, and AbuseCH ThreatFox.\nCommunicate your findings in professional, concise, and clear language suitable for technical security reporting.\nIdentify, emphasize, and extract key insights from each scan result, such as threat indicators, detection consistency, malicious activity patterns, or reputation data.\nAccount for the possibility of false positives. For example, a suspicious subdomain hosted under a legitimate parent (e.g., on cloud providers or hosting platforms) might not indicate the entire domain is malicious. \nIf possible, differentiate between malicious use of a service and a compromised or abused legitimate domain\nMaintain a neutral, evidence based tone, avoid assumptions not supported by the data.\nAvoid using absolute or emotional terms such as definitely, certainly, overwhelmingly, clearly malicious, or without doubt.\nUse probabilistic and evidence-based phrasing instead, such as likely, possibly, appears to, or based on available data.\nUse terminology appropriate for SOC or threat intelligence reporting.\nDo not include raw data unless explicitly requested." }, "position": [ 384, -64 ] }, { "id": "1fb7cacc-698d-4eb9-91b1-7ff96520cb45", "name": "Merge", "type": "merge", "params": { "numberInputs": 3 }, "position": [ 32, -80 ] }, { "id": "9bff600c-39c9-41af-83e3-26c8435daac4", "name": "Edit Field - ThreatFox", "type": "set", "params": { "options": {}, "assignments": { "assignments": [ { "id": "f3796464-d8d2-486a-8a2a-b425ebe68cec", "name": "sourceNode", "type": "string", "value": "ThreatFox" }, { "id": "0bb2ab43-87e3-421e-93cd-ee08c0668d17", "name": "DataSummary", "type": "string", "value": "={{JSON.stringify($json)}}" } ] } }, "position": [ -176, -400 ] }, { "id": "3395ff9b-966c-4e92-88f0-f0117ca1e095", "name": "Edit Field - URLHaus", "type": "set", "params": { "options": {}, "assignments": { "assignments": [ { "id": "f3796464-d8d2-486a-8a2a-b425ebe68cec", "name": "sourceNode", "type": "string", "value": "URLHaus" }, { "id": "0bb2ab43-87e3-421e-93cd-ee08c0668d17", "name": "DataSummary", "type": "string", "value": "={{JSON.stringify($json)}}" } ] } }, "position": [ -176, -64 ] }, { "id": "c74f5164-6842-48e5-b145-162906a6f8ed", "name": "Edit Field - VirusTotal", "type": "set", "params": { "options": {}, "assignments": { "assignments": [ { "id": "f3796464-d8d2-486a-8a2a-b425ebe68cec", "name": "sourceNode", "type": "string", "value": "VirusTotal" }, { "id": "0bb2ab43-87e3-421e-93cd-ee08c0668d17", "name": "DataSummary", "type": "string", "value": "={{JSON.stringify($json)}}" } ] } }, "position": [ -176, 240 ] } ] }

Analyze domain threats via Telegram with VirusTotal, AbuseCH, and Gemini AI