Check suspicious links via Telegram with GPT-4 analysis of VirusTotal & urlscan.io results

Workflow Purpose The workflow is designed to scan submitted URLs using urlscan.io and VirusTotal, combine the results into a single structured summary, and send the report via Telegram.

I built this workflow for people who primarily work from their phones and receive a constant stream of emails throughout the day. If a user gets an email asking them to sign a document, review a report, or take any action where the link looks suspicious, they can simply open the Telegram bot and quickly check whether the URL is safe before clicking it.

Key Components 1. Input / Trigger - Accepts URLs that need to be checked. - Initiates requests to VirusTotal and urlscan.io.

2. VirusTotal Scan - Always returns results if the URL is reachable. - Provides reputation, malicious/clean flags, and scan metadata.

3. urlscan.io Scan - Returns details on how the URL behaves when loaded (domains, requests, resources, etc.). - Sometimes fails due to blocks or restrictions.

4. Error Handling with Code Node - Checks whether urlscan.io responded successfully. - Ensures the workflow always produces a summary, even if urlscan.io fails.

5. Summary Generation - If both scans succeed → summarize combined findings from VirusTotal + urlscan.io. - If urlscan.io fails → state clearly in the summary “urlscan.io scan was blocked/failed. Relying on VirusTotal results.” - Ensures user still gets a complete security report.

6. Telegram Output - Final formatted summary is delivered to a Telegram chat via the bot. - Chat ID issue was fixed after the Code Node restructuring.