Description
n8n-nodes-scanmalware
This is an n8n community node for ScanMalware.com, a URL scanner run by Triop AB in Sweden. It lets your n8n workflows submit URLs for scanning, read the verdict, AI assessment, detections and screenshot of a scan, search public scans with the ScanMalware Query Language (SMQL) or by AI scam type, look up domains and IP addresses, follow brand impersonation, and read ScanMalware’s threat feeds.
ScanMalware loads each submitted URL in isolated analysis environments and checks the page with YARA rules, antivirus engines, IDS signatures and threat feeds. AI models review suspicious scans and classify them by scam type, such as credential phishing. The node uses the public REST API at https://scanmalware.com/api/v1, which needs no API key.
The node can also be used as a tool by n8n AI agents.
n8n is a fair-code licensed workflow automation platform.
Installation
Operations
Credentials
Data flow and privacy
Example workflows
Using it in an AI agent
Errors and rate limits
Compatibility
Resources
Version history
Installation
Follow the installation guide in the n8n community nodes documentation and install the package n8n-nodes-scanmalware.
Operations
| Resource | Operation | API endpoint |
| ———– | ——————————- | ————————————————————————————————————————————— |
| Scan | Submit | POST /api/v1/scan |
| Scan | Get Progress | GET /api/v1/result/{scan_id}/progress |
| Scan | Get Summary | GET /api/v1/scan/{scan_id}/summary |
| Scan | Get AI Analysis | GET /api/v1/ai/{scan_id} |
| Scan | Get Detections | GET /api/v1/ioc/{scanid}, /malware/{scanid}, /ids/alerts/{scanid}, /safe-browsing/{scanid}, /hunting-rules/scan/{scan_id} |
| Scan | Get Pivot Values | GET /api/v1/scans/{scan_id}/pivot-values |
| Scan | Get RDAP | GET /api/v1/rdap/{scan_id} |
| Scan | Get Screenshot | GET /api/v1/screenshot/{scan_id} |
| Search | SMQL Query | GET /api/v1/search/smql |
| Search | Search by AI Scam Type | GET /api/v1/ai/search/scam-type |
| Domain | Get Scans | GET /api/v1/domains/{domain}/scans |
| Domain | Get DNS | GET /api/v1/ct/dns/{domain} |
| Domain | Get DNS History | GET /api/v1/dns/history/{domain} |
| Domain | Get Hosts | GET /api/v1/hosts/{domain} |
| Domain | Get Certificates | GET /api/v1/ct/{domain} |
| Domain | Get Certificate Timeline | GET /api/v1/ct/timeline/{domain} |
| Domain | Get Stats | GET /api/v1/domain/stats/{domain} |
| IP | Get Stats | GET /api/v1/search/ip/{ip}/stats |
| IP | Get Scans | GET /api/v1/search/ip/{ip} |
| IP | Get CT Domains | GET /api/v1/ct/ip/{ip}/domains |
| Brand | Get | GET /api/v1/brands/{brand} |
| Brand | Get Impersonating Hosts | GET /api/v1/brands/{brand} (paged) |
| Brand | Get Many | GET /api/v1/brands |
| Brand | Get Timeline | GET /api/v1/brands/{brand}/timeline |
| Threat Feed | Get Recent Hunt Sightings | GET /api/v1/hunts/sightings/recent |
| Threat Feed | Get Recent Hunting Rule Matches | GET /api/v1/hunting-rules/threats/recent |
| Threat Feed | Get Recent Malware | GET /api/v1/malware/threats/recent |
Operations that return a list output one n8n item per row. A lookup that finds nothing returns no items, which stops the branch unless the node’s Always Output Data setting is on.
Scan > Submit
Submits a URL for scanning and returns the new scan_id. The scan runs in the background, so read the result with Get Summary once Get Progress reports it finished, usually about a minute later.
Visibility is required and has no default:
- Public publishes the URL and its results in the public ScanMalware feed and search, visible to everyone.
- Unlisted keeps the scan out of the public feed and search. Anyone who has the scan ID or the scan link can still open it.
Use Unlisted for anything private, such as links taken from internal email.
Example: URL https://example.com/login, Visibility Unlisted returns:
{
"scan_id": "3f2b1c4e-8a7d-4e21-9c55-0f1e2d3c4b5a",
"status": "queued",
"message": "Scan submitted successfully",
"scan_type": "unlisted",
"submitted_at": "2026-10-18T10:00:00"
}
Scan > Get Summary
Returns the status, security verdict and risk score of one scan. With Simplify on (the default) the output has ten flat fields: scanid, url, finalurl, status, completedat, verdict, risklevel, confidence, riskscore and riskfactors. Turn Simplify off for the full response, including the detailed analysis.
Example: Scan ID {{ $json.scan_id }} from a previous Submit node.
The verdict describes the submitted URL as it rendered at final_url. It can stay empty for a few minutes after status becomes completed; if it is empty, wait and run Get Summary again. An unknown scan ID returns a “not found” message.
Search > SMQL Query
Searches public scans with the ScanMalware Query Language and returns one item per matching scan. Filters include domain:, url:, ip:, asn:, technology:, ct_domain: and submitted:, combined with AND, OR, NOT and parentheses. domain: and url: also match the final URL after redirects, so results can include other sites that redirect to the domain.
Example: Query domain:example.com AND submitted:last7d, Limit 20. Under Options you can set the result Page and the Sort order.
Domain > Get Scans
Lists recent public scans of a domain and its subdomains, or of an IP address, one item per scan. Each row has matched_on, which says why it matched:
["url"] or ["url", "final_url"]: the scan was submitted for this domain.["final_url"]: the scan started at another site that redirected here.Read verdicts with care. A row whose matchedon does not contain "url", or whose url host differs from the queried domain, is a different site that only redirected there (often a phishing page imitating the domain) or a subdomain, so its verdict must not be read as the domain’s. The node adds verdictappliestodomain to every row: it is true only when matched_on contains "url" and the host of url is exactly the queried domain.
Example: Domain example.com, Limit 20, Options > Status Completed. A trailing dot (example.com.) is removed.
Domain > Get DNS
Returns the subdomains and IP addresses seen for a domain in Certificate Transparency logs and DNS resolution. With Simplify on, the output has domain, degraded, stale, subdomains, subdomaincount, subdomainsunresolved, subdomainstruncated, ipaddresses and totalrecords. Turn Simplify off to get dnsrecords, which holds each subdomain’s own addresses.
Example: Domain example.com, Options > Include Subdomains true, Subdomain Limit 100.
If degraded is true, ScanMalware skipped the lookup under load, so empty lists do not mean the domain has no subdomains; run the node again later. ip_addresses covers the domain and www only.
Scan > Get Progress
Returns status, stepname, currentstep, total_steps and percentage for a scan. status turns completed or failed when the scan has finished, so a workflow can loop on Get Progress with a Wait node instead of waiting a fixed time.
Scan > Get AI Analysis
Returns the AI assessment of a scan. With Simplify on, the output has classification (for example CONFIRMEDSCAM, HIGHRISK or LEGITIMATE), scamtype, riskscore (0 to 10), confidencepercentage, impersonatedbrand, recommendedaction, the AI’s verdict text, and the lists keyevidence, riskfactors and safetyfactors.
AI models review suspicious scans. A low-risk scan of a well-ranked domain is not reviewed: its verdict starts with “AI analysis skipped” and the node sets ai_skipped to true. The analysis appears after the scan has completed; until then the node reports that there is no AI analysis for the scan.
Scan > Get Detections
Reads what flagged a scan and returns one item. Pick the Sources to read (all five by default, one request each):
threat_feeds).antivirus_yara).ids_alerts).safe_browsing).hunting_rules).The item has scanstatus, a detectioncounts object with one count per source, and the full result of each source under the same key. The sources report nothing while a scan is still running, so check that scan_status is completed. A count above zero is a finding to review, not a verdict on its own: some IDS alerts are informational.
Scan > Get Pivot Values
Returns the values of a scan that can be searched across other scans: page and script hashes, script URLs and hosts, tracking IDs, YARA rule names, linked hosts and more. Pivot types with no value are left out unless Options > Include Empty Values is on. Search a value with Search > SMQL Query to find other scans that share it.
Scan > Get RDAP
Returns the registration data of the scanned domain. With Simplify on: domain, registrar, registrationdate, expirationdate, domainagedays, domainagecategory, nameservers, status, data_source and error.
The data describes the registered domain of the submitted URL. For a page on a shared platform such as pages.dev or vercel.app, the domain age is the platform’s, not the page’s.
Scan > Get Screenshot
Downloads the screenshot of a scanned page into a binary field (data by default), ready to attach to a Slack, Microsoft Teams or email alert. Under Options you can choose PNG or WebP and a Width in pixels (50 to 2000, aspect ratio kept). The node checks that ScanMalware returned an image; while a scan is still running it reports that the screenshot is not ready yet.
Search > Search by AI Scam Type
Finds scans that the AI classified as one scam type, such as Credential Phishing, Fake Shopping or Tech Support Scam, and returns one item per scan with the same simplified fields as Get AI Analysis plus url, title and submitted_at. The list holds the 16 most common types; to search a rarer one, switch the parameter to an expression and enter its exact label.
Domain > Get DNS History, Get Hosts, Get Certificates, Get Certificate Timeline, Get Stats
These take a domain name only; for an IP address use the IP resource.
type, value, firstseen, lastseen and source. source says how it was seen: scan (looked up when a public page using the name was scanned), certificate (resolved when a TLS certificate was published) or reverse_dns. It is not a continuous record: what DNS said between two sightings is unknown.observed) or loaded scripts from (scripts), and the domain’s subdomains seen in those scans.loggedat and the ipaddresses the name resolved to when it was logged.IP > Get Stats, Get Scans, Get CT Domains
These take an IPv4 or IPv6 address.
hostnames. Addresses are not re-checked, so a domain that moved to the address later is not listed, and shared hosting or CDN addresses carry many unrelated domains.Brand > Get, Get Impersonating Hosts, Get Many, Get Timeline
ScanMalware follows more than a thousand brands for impersonation. Pick the Brand from the searchable list, or enter its slug (such as paypal).
campaigns (threat hunts) that target it and the hosting platforms and TLDs used (infrastructure).firstseen, lastseen, the number of sightings and the title and verdict of the host’s newest scan. Hide Lower-Risk Hosts (on by default, like the brand page on scanmalware.com) leaves out hosts that neither detection engine rates high and the AI assessed as at most moderate. Turn on Return All to page through every host.Threat Feed > Get Recent Hunt Sightings, Get Recent Hunting Rule Matches, Get Recent Malware
Recent findings across all public scans, one item per finding:
Credentials
No credentials needed. The ScanMalware API is public and keyless, so the node has no credential type and nothing to configure.
Data flow and privacy
The node only talks to https://scanmalware.com. It sends what each operation needs and nothing else from your workflow:
Every request also carries the user agent scanmalware-n8n/ and comes from the IP address of your n8n instance. ScanMalware records requests, including what was looked up, in its logs, and hostnames that appear in lookups can be queued for its own scanner (scans started that way are unlisted). See Lookups, API requests and logs in the ScanMalware privacy policy for what is kept and for how long.
Public scans are visible to everyone: the URL, a screenshot and the analysis results appear in the public feed and in search. Choose Unlisted when the URL or its content should not be published.
Example workflows
The workflows are in the examples folder and can be imported with Workflows > Import from File. They use example.com and PayPal so that they run as they are.
Triage a suspicious URL from an email
examples/triage-suspicious-url.json
1. Email Trigger (IMAP) receives a reported message. (The example file starts with a Manual Trigger and a Set node holding the URL; replace both with your trigger and an expression that extracts the link.)
2. ScanMalware, Scan > Submit with Visibility Unlisted, so the reported link is not published.
3. Wait 60 seconds.
4. ScanMalware, Scan > Get Summary with Scan ID {{ $('Submit Unlisted Scan').item.json.scan_id }}.
5. If risk_level is high or malicious, alert your team (Slack, Microsoft Teams or email). Otherwise, if status is not completed yet or verdict is still empty, loop back to the Wait node.
Watch scans of your domain
examples/watch-domain-scans.json
1. Schedule Trigger once a day (the example file uses a Manual Trigger).
2. ScanMalware, Domain > Get Scans for your domain with Options > Status Completed.
3. If verdictappliestodomain is true, run ScanMalware, Scan > Get Summary with Scan ID {{ $json.scanid }} and alert when risk_level is high or malicious.
4. Rows where verdictappliesto_domain is false started at another site. Their verdict is not your domain’s, but they are worth a look as possible impersonation.
Watch for new sites impersonating a brand
examples/monitor-brand-impersonation.json
1. Schedule Trigger once a day (the example file uses a Manual Trigger).
2. ScanMalware, Brand > Get Impersonating Hosts for your brand, with Return All on.
3. If first_seen is within the last 24 hours, the host is new.
4. ScanMalware, Scan > Get Screenshot with Scan ID {{ $json.scan_id }}, then send the host, its verdict and the screenshot to your team. (The example ends at the screenshot; add your Slack, Microsoft Teams or email node.)
Using it in an AI agent
The node is marked usableAsTool, so it can be attached to an n8n AI Agent node as a tool. For each parameter you can either set a fixed value or let the model fill it in. Two suggestions:
Errors and rate limits
The node reports API failures with a short message and a hint, and does not retry on its own:
Retry-After time when the API sends one. Run the node again later, add a Wait node, or process items in smaller batches.Turn on Settings > On Error > Continue to keep a workflow running and receive the message in an error field instead.
Compatibility
Built with the @n8n/node-cli tooling (n8n nodes API version 1). Tested with n8n 2.43.7.
Resources
Version history
0.2.0
22 new operations; the five 0.1.0 operations, their parameters and their output are unchanged.
0.1.0
First release: Scan > Submit, Scan > Get Summary, Search > SMQL Query, Domain > Get Scans and Domain > Get DNS.
License
MIT, copyright Triop AB.
