Link Checker Bot Workflow + Phishing ke 5 Nishaan

'KYC update karo, warna account band' jaisa message aaya aur saath mein ek link? Click karne se pehle ek rukawat chahiye. Is guide mein ek chhota n8n workflow hai: tum link Telegram bot ko bhejte ho, n8n use urlscan.io se scan karwata hai, aur result tumhe Telegram pe wapas milta hai. Link tumne khud kholna nahi padta: scan urlscan.io ka browser karta hai, tumhara phone ya laptop nahi.

Reel mein jo link ('kyc-update.example') aur jo reply cards dikhe, wo banaya hua example hain: .example ek reserved naam hai, koi asli site nahi. Hamne ye workflow kisi account par chalaya nahi hai. Ye starter workflow hai, n8n ke official preview mein dikhaya gaya: credentials khud jodo, ek test se check karo. Jis field ke aage 'ek test mein check karo' likha hai, uska naam hamne live run mein confirm nahi kiya.

Node by node (n8n aur urlscan.io ke official docs ke hisaab se)

Field ke naam: ek test mein check karo

• Scan ID (scanId): n8n ka urlscan.io node Perform ke result mein urlscan ka 'uuid' ya '_id' field 'scanId' naam se deta hai (node ke source code ke hisaab se), aur n8n ka apna published template 'Phishing analysis - URLScan.io and VirusTotal' bhi Get mein {{ $json.scanId }} lagata hai. Phir bhi Run Scan ka output khol ke dekh lo.
• Report ka link: urlscan.io ka submit response 'uuid', 'result' (scan ka web page) aur 'api' deta hai (urlscan.io API docs). Hamare replies 'result' padhte hain: {{ $('Run Scan').item.json.result }}. Run Scan ke output mein ye field dekh lo.
• 'Flag laga' ka field: urlscan.io ke Result API docs ke hisaab se result mein 'verdicts' hota hai, jiske subkeys urlscan, engines aur community hain; documented score 'verdicts.urlscan.score' hai (-100 matlab legitimate, 100 matlab malicious). Hamari If condition 'verdicts.overall.malicious' (true/false) padhti hai, jo docs ke us page par naam se nahi likha hai. Get Result ke output mein dekho ki tumhare result mein ye field isi naam se aata hai. Na aaye, to If ko 'verdicts.urlscan.score' par number comparison bana do.

Kya chahiye

• n8n: apne server par self-host (Community Edition) ya n8n Cloud (free trial). Kharche ka section neeche hai.
• n8n HTTPS pe: n8n docs ke hisaab se Telegram Trigger ko 'An HTTPS URL must be provided for webhook'. Reverse proxy ke peeche ho to WEBHOOK_URL apne public HTTPS address par set karo. Telegram Bot API bhi webhook ke liye HTTPS URL maangta hai.
• Telegram bot ka Access Token: Telegram par BotFather se chat shuru karo, /newbot likho, naam aur username do (username 'bot' par khatam hona chahiye), jo token mile use n8n mein Access Token ki jagah daalo.
• urlscan.io account aur API key: urlscan.io par account banao, Settings & API > API Keys se key lo, aur n8n mein urlscan.io credential banao. (urlscan.io docs: bina login ke use mein sirf chhote quota milte hain, API key wale ko zyada.)

Step by step

1. n8n kholo (HTTPS wala self-host ya Cloud trial) aur naya workflow banao.
2. Neeche wala starter workflow Import from File se laao, ya JSON copy karke canvas par paste karo.
3. New Link node mein Telegram credential chuno (ya naya banao: BotFather ka token).
4. Run Scan aur Get Result mein urlscan.io credential chuno (ya naya banao: API key). Run Scan ke Additional Fields mein Visibility = Private check karo.
5. Risky Reply aur No Flag Reply mein wahi Telegram credential chuno.
6. Pehle ek harmless link se test karo (jaise apni khud ki site). Bot ko sirf link bhejo, aur kuch nahi: poora message text URL ki tarah scan hota hai (ek test mein check karo).
7. Executions mein Run Scan aur Get Result ka output dekho: scanId, result aur verdicts wale field tumhare naam se aate hain ya nahi. Na aayein to expressions theek karo.
8. Sab theek chale to workflow publish karo aur n8n chalu rakho. Ab shak wala link bot ko bhejo, aur reply padho.

{
  "name": "Link Checker Bot Starter",
  "nodes": [
    {
      "id": "1",
      "name": "New Link",
      "type": "n8n-nodes-base.telegramTrigger",
      "typeVersion": 1.2,
      "position": [
        0,
        0
      ],
      "parameters": {
        "updates": [
          "message"
        ],
        "additionalFields": {}
      }
    },
    {
      "id": "2",
      "name": "Run Scan",
      "type": "n8n-nodes-base.urlScanIo",
      "typeVersion": 1,
      "position": [
        300,
        0
      ],
      "parameters": {
        "resource": "scan",
        "operation": "perform",
        "url": "={{ $json.message.text }}",
        "additionalFields": {
          "visibility": "private"
        }
      }
    },
    {
      "id": "3",
      "name": "Wait Scan",
      "type": "n8n-nodes-base.wait",
      "typeVersion": 1.1,
      "position": [
        600,
        0
      ],
      "parameters": {
        "amount": 20,
        "unit": "seconds"
      }
    },
    {
      "id": "4",
      "name": "Get Result",
      "type": "n8n-nodes-base.urlScanIo",
      "typeVersion": 1,
      "position": [
        900,
        0
      ],
      "parameters": {
        "resource": "scan",
        "operation": "get",
        "scanId": "={{ $('Run Scan').item.json.scanId }}"
      },
      "retryOnFail": true,
      "maxTries": 3,
      "waitBetweenTries": 5000
    },
    {
      "id": "5",
      "name": "Flagged?",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2.2,
      "position": [
        1200,
        0
      ],
      "parameters": {
        "conditions": {
          "options": {
            "caseSensitive": true,
            "typeValidation": "loose",
            "version": 2
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "c1",
              "leftValue": "={{ $json.verdicts.overall.malicious }}",
              "rightValue": "",
              "operator": {
                "type": "boolean",
                "operation": "true",
                "singleValue": true
              }
            }
          ]
        },
        "options": {}
      }
    },
    {
      "id": "6",
      "name": "Risky Reply",
      "type": "n8n-nodes-base.telegram",
      "typeVersion": 1.2,
      "position": [
        1500,
        -120
      ],
      "parameters": {
        "chatId": "={{ $('New Link').item.json.message.chat.id }}",
        "text": "=Risky lag raha hai, mat kholo. Report: {{ $('Run Scan').item.json.result }}",
        "additionalFields": {
          "appendAttribution": false
        }
      }
    },
    {
      "id": "7",
      "name": "No Flag Reply",
      "type": "n8n-nodes-base.telegram",
      "typeVersion": 1.2,
      "position": [
        1500,
        140
      ],
      "parameters": {
        "chatId": "={{ $('New Link').item.json.message.chat.id }}",
        "text": "=Koi flag nahi mila, par safe ki guarantee nahi. Domain khud check karo. Report: {{ $('Run Scan').item.json.result }}",
        "additionalFields": {
          "appendAttribution": false
        }
      }
    }
  ],
  "connections": {
    "New Link": {
      "main": [
        [
          {
            "node": "Run Scan",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Run Scan": {
      "main": [
        [
          {
            "node": "Wait Scan",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Wait Scan": {
      "main": [
        [
          {
            "node": "Get Result",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Get Result": {
      "main": [
        [
          {
            "node": "Flagged?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Flagged?": {
      "main": [
        [
          {
            "node": "Risky Reply",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "No Flag Reply",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Is JSON mein credentials nahi hain: Telegram aur urlscan.io credential tumhe khud jodne hain. Reply ke texts Hinglish mein hain, apni marzi se badal sakte ho. Get Result par Retry On Fail on hai (tries aur beech ka wait JSON mein hai: maxTries 3, waitBetweenTries 5000 ms); phir bhi kabhi scan zyada time le to Wait ka amount badha do.

Privacy aur safety (zaroor padho)

Phishing ke 5 nishaan (official advisories ke hisaab se)

1. Jaldi ka dabaav ya dhamki: 'abhi update karo warna account band / freeze / block ho jayega'. RBI: fraudster 'false urgency' banate hain aur account freezing / blocking / closure ki dhamki dete hain.
2. Anjaan SMS, call ya email jo link ya app ke saath KYC update maange. RBI: KYC update ki request aaye to seedha apne bank se contact karo, aur bank ka number sirf uski official website ya official source se lo, message ke link ya number se nahi.
3. OTP, PIN, password, card ki jaankari ya KYC documents maangna. RBI: login credentials, card information, PIN, password aur OTP kisi se share mat karo, aur sensitive jaankari unverified website ya app par mat daalo.
4. Link ke naam mein spelling ki galti, ya link 'https' se shuru nahi hota. RBI: emails / SMS mein aaye URL aur domain name ki spelling check karo, aur sirf 'https' se shuru hone wali verified websites / apps use karo.
5. Anjaan app install karwana, ya inaam / lottery / paison ke deposit ka lalach. RBI: fraudster tumhe app download karwa ke tumhare phone ka data dekh sakte hain, aur RBI ke naam se deposit ya lottery jeetne ki baaton mein mat aao.

Ye nishaan RBI ke public awareness press releases se hain (links neeche). Ek nishaan bhi dikhe, to link mat kholo. Tumhara bot ek madad hai, in nishaano ki jagah nahi leta.

Aam galtiyan

• n8n HTTPS pe nahi hai. Telegram Trigger 'An HTTPS URL must be provided for webhook' error deta hai (n8n docs). Public HTTPS address aur WEBHOOK_URL set karo.
• Test aur production ek hi bot par. n8n docs: Telegram ek app par sirf ek webhook register karne deta hai, to test aur production ek doosre ka webhook overwrite karte hain. Test ke liye alag bot bana lo.
• Scan ko bahut kam time diya. urlscan.io: scan chalte waqt result endpoint 404 deta hai. Wait badhao, ya Get Result par Retry On Fail rakho.
• Bot ko link ke saath aur kuch likh diya. Poora message text URL ban jaata hai (ek test mein check karo): sirf link bhejo.
• Visibility default par chhod di. urlscan.io: agar visibility na bhejo to scan tumhari configured default visibility par jaata hai. Hamare JSON mein 'private' khud likha hai: ise mat hatao.
• Reply par 'This message was sent automatically with n8n' lag raha hai. Send Message ke Additional Fields mein 'Append n8n Attribution' off karo (hamare JSON mein off hai).

Kharcha (plans badalte rehte hain, official page dekho)

Official links