n8n-nodes-scanmalware

This is an n8n community node for ScanMalware.com, a URL scanner run by Triop AB in Sweden. It lets your n8n workflows submit URLs for scanning, read the security verdict of a scan, search public scans with the ScanMalware Query Language (SMQL), and look up the scans and DNS history of a domain.

ScanMalware loads each submitted URL in isolated analysis environments and checks the page with YARA rules, antivirus engines, IDS signatures and threat feeds. The node uses the public REST API at https://scanmalware.com/api/v1, which needs no API key.

The node can also be used as a tool by n8n AI agents.

n8n is a fair-code licensed workflow automation platform.

Installation
Operations
Credentials
Data flow and privacy
Example workflows
Using it in an AI agent
Errors and rate limits
Compatibility
Resources
Version history

Installation

Follow the installation guide in the n8n community nodes documentation and install the package n8n-nodes-scanmalware.

Operations

Scan > Submit

Submits a URL for scanning and returns the new scan_id. The scan runs in the background, so read the result with Get Summary about a minute later.

Visibility is required and has no default:

• Public publishes the URL and its results in the public ScanMalware feed and search, visible to everyone.
• Unlisted keeps the scan out of the public feed and search. Anyone who has the scan ID or the scan link can still open it.

Use Unlisted for anything private, such as links taken from internal email.

Example: URL https://example.com/login, Visibility Unlisted returns:

{
  "scan_id": "3f2b1c4e-8a7d-4e21-9c55-0f1e2d3c4b5a",
  "status": "queued",
  "message": "Scan submitted successfully",
  "scan_type": "unlisted",
  "submitted_at": "2026-10-18T10:00:00"
}

Scan > Get Summary

Returns the status, security verdict and risk score of one scan. With Simplify on (the default) the output has ten flat fields: scan_id, url, final_url, status, completed_at, verdict, risk_level, confidence, risk_score and risk_factors. Turn Simplify off for the full response, including the detailed analysis.

Example: Scan ID {{ $json.scan_id }} from a previous Submit node.

The verdict describes the submitted URL as it rendered at final_url. It can stay empty for a few minutes after status becomes completed; if it is empty, wait and run Get Summary again. An unknown scan ID returns a "not found" message.

Search > SMQL Query

Searches public scans with the ScanMalware Query Language and returns one item per matching scan. Filters include domain:, url:, ip:, asn:, technology:, ct_domain: and submitted:, combined with AND, OR, NOT and parentheses. domain: and url: also match the final URL after redirects, so results can include other sites that redirect to the domain.

Example: Query domain:example.com AND submitted:last7d, Limit 20. Under Options you can set the result Page and the Sort order.

Domain > Get Scans

Lists recent public scans of a domain and its subdomains, or of an IP address, one item per scan. Each row has matched_on, which says why it matched:

• ["url"] or ["url", "final_url"]: the scan was submitted for this domain.
• ["final_url"]: the scan started at another site that redirected here.

Read verdicts with care. A row whose matched_on does not contain "url", or whose url host differs from the queried domain, is a different site that only redirected there (often a phishing page imitating the domain) or a subdomain, so its verdict must not be read as the domain's. The node adds verdict_applies_to_domain to every row: it is true only when matched_on contains "url" and the host of url is exactly the queried domain.

Example: Domain example.com, Limit 20, Options > Status Completed. A trailing dot (example.com.) is removed.

Domain > Get DNS

Returns the subdomains and IP addresses seen for a domain in Certificate Transparency logs and DNS resolution. With Simplify on, the output has domain, degraded, stale, subdomains, subdomain_count, subdomains_unresolved, subdomains_truncated, ip_addresses and total_records. Turn Simplify off to get dns_records, which holds each subdomain's own addresses.

Example: Domain example.com, Options > Include Subdomains true, Subdomain Limit 100.

If degraded is true, ScanMalware skipped the lookup under load, so empty lists do not mean the domain has no subdomains; run the node again later. ip_addresses covers the domain and www only.

Credentials

No credentials needed. The ScanMalware API is public and keyless, so the node has no credential type and nothing to configure.

Data flow and privacy

The node only talks to https://scanmalware.com. It sends what each operation needs and nothing else from your workflow:

• Submit sends the URL and the visibility you chose.
• Get Summary sends the scan ID.
• SMQL Query sends the query text, limit, page and sort order.
• Get Scans and Get DNS send the domain or IP address and the options you set.

Every request also carries the user agent scanmalware-n8n/<version> and comes from the IP address of your n8n instance. ScanMalware records requests, including what was looked up, in its logs, and hostnames that appear in lookups can be queued for its own scanner (scans started that way are unlisted). See Lookups, API requests and logs in the ScanMalware privacy policy for what is kept and for how long.

Public scans are visible to everyone: the URL, a screenshot and the analysis results appear in the public feed and in search. Choose Unlisted when the URL or its content should not be published.

Example workflows

Both workflows are in the examples folder and can be imported with Workflows > Import from File. They use example.com so that they run as they are.

Triage a suspicious URL from an email

examples/triage-suspicious-url.json

1. Email Trigger (IMAP) receives a reported message. (The example file starts with a Manual Trigger and a Set node holding the URL; replace both with your trigger and an expression that extracts the link.)
2. ScanMalware, Scan > Submit with Visibility Unlisted, so the reported link is not published.
3. Wait 60 seconds.
4. ScanMalware, Scan > Get Summary with Scan ID {{ $('Submit Unlisted Scan').item.json.scan_id }}.
5. If risk_level is high or malicious, alert your team (Slack, Microsoft Teams or email). Otherwise, if status is not completed yet or verdict is still empty, loop back to the Wait node.

Watch scans of your domain

examples/watch-domain-scans.json

1. Schedule Trigger once a day (the example file uses a Manual Trigger).
2. ScanMalware, Domain > Get Scans for your domain with Options > Status Completed.
3. If verdict_applies_to_domain is true, run ScanMalware, Scan > Get Summary with Scan ID {{ $json.scan_id }} and alert when risk_level is high or malicious.
4. Rows where verdict_applies_to_domain is false started at another site. Their verdict is not your domain's, but they are worth a look as possible impersonation.

Using it in an AI agent

The node is marked usableAsTool, so it can be attached to an n8n AI Agent node as a tool. For each parameter you can either set a fixed value or let the model fill it in. Two suggestions:

• Fix Visibility to Unlisted in a Submit tool, so the model cannot publish URLs by itself.
• Keep Simplify on, so the agent receives short, flat results.

Errors and rate limits

The node reports API failures with a short message and a hint, and does not retry on its own:

• Not found (404): the scan ID does not exist, or nothing is recorded for the request.
• Rate limited (429): ScanMalware asked the workflow to slow down. The message includes the Retry-After time when the API sends one. Run the node again later, add a Wait node, or process items in smaller batches.
• Invalid input (400 or 422): the message names the parameter the API did not accept, for example an SMQL query that could not be parsed.

Turn on Settings > On Error > Continue to keep a workflow running and receive the message in an error field instead.

Compatibility

Built with the @n8n/node-cli tooling (n8n nodes API version 1). Tested with n8n 2.43.7.

Resources

• ScanMalware API documentation
• ScanMalware privacy policy, API requests
• n8n community nodes documentation

Version history

0.1.0

First release: Scan > Submit, Scan > Get Summary, Search > SMQL Query, Domain > Get Scans and Domain > Get DNS.

License

MIT, copyright Triop AB.