Automated URL Scanning and Gmail Reporting via Webhook - n8n Workflow

• Security analysts needing to automate triage of suspicious URLs.


• DevOps teams integrating security scanning into CI/CD or monitoring processes.


• Developers looking for reusable n8n templates for external API consumption.


• Users seeking an example of flow control (Wait n8n node) and dynamic email generation within an n8n workflow.

This robust n8n workflow template provides an immediate, automated method for submitting suspicious or unknown URLs to the urlscan.io public scanning service. The core problem this n8n automation solves is bridging the gap between an event (receiving a potentially malicious URL) and actionable security intelligence. By setting up a custom n8n trigger using the Webhook n8n node, the workflow can be easily integrated into any system (such as a SIEM or internal reporting tool).

The implementation uses a key n8n node, the Wait node, to handle the asynchronous nature of the scanning process, ensuring that screenshots and detailed reports are ready before the final action. The resulting report is cleanly formatted and delivered via the Gmail n8n node, providing direct links to the scan results, the captured screenshot, and the full API JSON response, making this an invaluable n8n workflow for rapid security response.

This efficient n8n workflow is designed for seamless, automated execution, starting with a powerful n8n trigger and flowing through critical steps to deliver the final report.

1. Webhook n8n trigger: The process begins when an external system sends an HTTP POST request containing the target URL to the /urlscan endpoint defined in the Webhook n8n node. This n8n trigger activates the automation.


2. Initiate Scan (urlscan.io n8n node): The data received from the n8n trigger is passed to the urlscan.io n8n node, which submits the URL for analysis. It captures the unique Scan ID (UUID) required to retrieve the results.


3. Flow Control (Wait n8n node): Recognizing that external scans take time, the n8n workflow pauses for a fixed duration of 30 seconds using the Wait n8n node. This ensures urlscan.io has enough time to generate all required artifacts, like high-resolution screenshots.


4. Send Notification (Gmail n8n node): The final step of the n8n workflow uses the Gmail n8n node to construct and send a detailed email. The email dynamically includes the scanned URL, the result page URL, and direct links for both the screenshot (using the captured UUID) and the raw API JSON data. This completes the fully automated n8n workflow.

To deploy this n8n workflow template and begin automating your URL scanning:

1. Import the n8n workflow: Copy the provided JSON data and paste it into your n8n instance via the 'New' menu and selecting 'Import from JSON'.


2. Configure Credentials:

1. Update Gmail Recipient: Open the 'Send a message' Gmail n8n node and update the sendTo parameter from [email protected] to your desired recipient address.


2. Activate the n8n trigger: Activate the Webhook n8n node. Retrieve the test or production webhook URL from the node settings.


3. Test the n8n workflow: Send a POST request to your webhook URL with a JSON body containing the key url and a target URL value (e.g., {"url": "https://example.com"}).

Webhook (n8n trigger):
Function: Serves as the primary n8n trigger, initiating the n8n workflow upon receiving an HTTP POST request.
Key Configuration: Configured to listen on the path /urlscan and expects a JSON body containing the URL to be scanned.
Perform a scan (urlscan.io n8n node):
Function: Submits the URL extracted from the Webhook payload to the urlscan.io API to start a security scan.
Key Configuration: Dynamically pulls the URL using expressions: ={{ $json.body?.url?.[0] ?? $json.body?.url ?? $json.url }}.
Wait (n8n node):
Function: Pauses the execution of the n8n workflow for a specified time to allow the external API (urlscan.io) to complete processing and generate artifacts.
Key Configuration: Set to wait for 30 seconds.
Send a message (Gmail n8n node):
Function: Compiles the results obtained from the previous n8n node and sends a comprehensive report via email.
Key Configuration: Uses HTML content in the message body to embed dynamic links, including the generated scan ID in the screenshot URL: https://urlscan.io/screenshots/{{ $json.scanId }}.png.