Check phishing URL reputation with VirusTotal and log to Google Sheets

🐟 Phishing URL Reputation Checker with VirusTotal

This n8n template helps you automatically analyze URLs for phishing and malicious activity using VirusTotal’s multi-engine threat intelligence platform. It validates incoming URLs, submits them for scanning, polls for results, classifies risk, and logs verdicts for monitoring and incident response workflows.

Use cases include security automation, SOC alerting, phishing triage pipelines, chatbot URL validation, and email security enrichment. This template is ideal for blue teams, security engineers, and automation builders who want real-time URL reputation checks without building a full security pipeline from scratch.

💡 Good to know

- VirusTotal enforces API rate limits. For high-volume environments, consider increasing polling intervals or rotating API keys.

- The workflow defangs suspicious and malicious URLs to prevent accidental clicks during investigation.

- This template uses asynchronous polling because VirusTotal scans are not always immediately available.

⚙️ How it works