Heidelberg AICurriculum

I Automated My Home Security With n8n (Free Workflows Inside)

n8n ·2026-07-01 ·2 min read

Summary written by us from the video's transcript. The video, and everything in it, is n8n's work.

Learn how to use n8n to automate detection of phishing emails and firewall blocks by integrating Gmail, VirusTotal, URLScan, and a Ubiquiti router.

Takeaways

  • Automating phishing detection with n8n lets you label malicious emails within minutes using VirusTotal scores.
  • A Ubiquiti router can forward block events to n8n, enabling instant enrichment via VirusTotal and URLScan.
  • The email workflow reconstructs raw MIME data so headers and URLs are parsable for analysis.
  • Conditional labeling (confirmed fishing vs. false positive) keeps your inbox clean without manual review.
  • Both workflows are modular; you can replace Gmail with Outlook or add additional threat‑intel services as needed.

Why automation matters

Phishing emails can compromise credentials and lead to fraud, as illustrated by the Debbie scenario where a malicious PDF infected her machine and exposed QuickBooks and Stripe data. Automated detection shortens response time from days or months to minutes, reducing the risk of lateral movement and data exfiltration.

Email‑based phishing workflow

The workflow polls Gmail every 10 minutes for messages labeled **reported fishing** (or any incoming email if you adjust the trigger). It reconstitutes the raw MIME attachment into a parsable format, extracts all URLs, and queries VirusTotal. If VirusTotal already knows the URL, its existing verdict is used; otherwise the URL is submitted for analysis.

If the triage score meets a malicious threshold, the workflow adds a **confirmed fishing** label, marks analysis as complete, and removes the original reported‑fishing tag. Clean URLs receive a **false positive** label.

Understanding VirusTotal integration

VirusTotal aggregates scans from many antivirus engines; it returns detection counts for files or URLs. The workflow uses this data to compute a criticality rating that drives labeling decisions. A manual check of the demo URL showed six AV vendors flagging it as malicious, confirming the workflow’s usefulness.

Firewall‑alert workflow

When a Ubiquiti firewall blocks a request (e.g., an inbound connection from China), the block event can be sent to n8n via webhook. The workflow again calls VirusTotal and also queries **URLScan** for visual screenshots, redirects, and indicators of compromise.

The combined report is assembled in seconds, giving you immediate context about the blocked threat without manually visiting the URL.

Leveraging Ubiquiti as a front‑line defense

Ubiquiti’s Pro Series hardware (e.g., UDM‑SE) sits between your ISP modem and internal network, providing unified threat management, ad blocking, and geo‑blocking. Logs from the device show blocked ads and country filters, which can trigger the n8n firewall workflow for deeper analysis.

Customizing and scaling the solution

Both workflows are built with reusable nodes: Gmail trigger, HTTP request to VirusTotal, HTTP request to URLScan, conditional labeling, and webhook output. You can change the Gmail trigger to run on every email, auto‑archive suspicious messages, or extend the firewall workflow to other security appliances that support webhooks.