AI-Powered Link Security and Threat Analyzer - n8n Workflow

Security analysts or teams needing instant threat intelligence.
Developers building internal tools for phishing link verification.
n8n users looking for advanced n8n templates integrating AI and external scanning tools.
Anyone seeking a powerful, automated n8n node sequence for security monitoring.

This sophisticated n8n workflow provides instant, AI-driven security analysis for any URL submitted via a webhook. Instead of manually checking detailed scan results, this n8n automation template leverages the urlscan.io n8n node to generate detailed artifacts and then utilizes a powerful GPT model (via the OpenAI n8n node) to interpret the raw security data. The core value of this n8n workflow is transforming complex API output into a clear, actionable risk report, delivered directly through a Gmail notification. This robust n8n node setup ensures rapid threat assessment, making it one of the most practical n8n templates for cybersecurity operations. The workflow handles the asynchronous nature of scanning by incorporating a necessary 'Wait' n8n node, ensuring data integrity before AI processing.

The process begins with the Webhook n8n trigger, which listens for an incoming POST request containing the target URL. This initial n8n node expects input in a specific JSON format, providing the URL to be scanned. Next, the Perform a scan urlscan.io n8n node submits this URL for analysis, retrieving a unique scan ID. A critical step follows: the Wait n8n node pauses the execution for 30 seconds. This pause is essential in the n8n workflow, ensuring urlscan.io has time to complete the security analysis and compile the full report and screenshots.

Once the artifacts are ready, the Message a model OpenAI n8n node is executed. This n8n node acts as a virtual security analyst, analyzing the resulting API JSON data. It is specifically prompted to generate a structured JSON output containing a classification (malicious/suspicious/benign), a riskScore (1-10), and a short summary.

Finally, the Send a message Gmail n8n node compiles the comprehensive analysis—including the AI summary, risk score, classification, and links to the full urlscan.io report and screenshot—into an actionable email notification. This seamless n8n workflow demonstrates the power of combining specialized services with large language models.

To deploy this n8n workflow template successfully, follow these steps:

1. Import the JSON: Copy the provided n8n workflow JSON and import it into your n8n instance.


2. urlscan.io Credentials: Configure the Perform a scan n8n node by setting up a new urlscan.io API Key credential.


3. OpenAI Credentials: Set up your OpenAI API key credentials for the Message a model n8n node.


4. Gmail Credentials: Set up the required OAuth2 credentials for the Gmail n8n node.


5. Configure Recipient: In the Send a message n8n node, update the Send To email address (currently set to [email protected]) to your desired recipient.


6. Activate: Enable the n8n workflow. The Webhook n8n trigger will now be live at the path /url-scan (or as configured).


7. Testing: Send a POST request to your n8n trigger URL with a body containing {"url": "https://example.com"} to test the full n8n automation process.

Webhook (n8n trigger):
Function: Starts the n8n workflow upon receiving an HTTP POST request.
Key Configuration: Method set to POST, Path set to /url-scan. It captures the target URL from the incoming request body.
Perform a scan (urlscan.io n8n node):
Function: Submits the URL extracted by the n8n trigger to urlscan.io for security analysis.
Key Configuration: Uses an Expression to dynamically pass ={{ $json.body.url[0] }}.
Wait (n8n node):
Function: Pauses the n8n workflow execution for 30 seconds, allowing urlscan.io to finalize the scan and generate results, which is crucial for subsequent AI analysis.
Message a model (OpenAI n8n node):
Function: Analyzes the security data (specifically the API link output from urlscan.io) and generates a structured classification, risk score, and summary using a GPT model. This n8n node ensures intelligent data interpretation.
Key Configuration: Uses a system prompt to enforce a specific JSON output structure (classification, riskScore, summary).
Send a message (Gmail n8n node):
Function: Sends the final, summarized security report via email. This n8n node incorporates data from the Webhook, urlscan.io, and the OpenAI analysis.
Key Configuration: The email body is built using HTML and expressions to dynamically display the AI classification and link to the full report and screenshot.