Steam + CF Report
This workflow receives domain query requests via Webhook, automatically verifies the domain format and DNS records, checks whether it is using Cloudflare services, and promptly sends alert emails to the Cloudflare and Steam security teams based on the results. It integrates command-line tools for domain resolution, ensuring data accuracy and logical rigor, effectively assisting the cybersecurity team in quickly identifying and reporting potential phishing websites, enhancing the response efficiency to phishing threats, and protecting user asset security.
Tags
Workflow Name
Steam + CF Report
Key Features and Highlights
This workflow receives domain query requests via Webhook, automatically validates the domain format and its DNS records, checks whether the domain is using Cloudflare’s network services, and based on the detection results, automatically sends alert emails to the Cloudflare security team and the official Steam security mailbox. The workflow integrates the command-line tool bind-tools for domain resolution and employs conditional nodes to implement multi-level verification, ensuring data accuracy and robust processing logic.
Core Problems Addressed
To combat phishing websites impersonating the Steam brand, this workflow rapidly detects whether the submitted domain is valid and whether it uses Cloudflare as its DNS provider, thereby assessing its risk level. It promptly notifies relevant security teams of potential phishing domains, aiding in the fight against phishing attacks and protecting user assets.
Application Scenarios
- Rapid identification and reporting of Steam phishing sites by cybersecurity monitoring teams
- Automated response to potentially malicious domains by cloud security service providers
- Enhanced phishing threat response efficiency through automation in enterprise internal security operations
- Automated collection and reporting of phishing threat information by anti-phishing projects or communities
Main Process Steps
- Receive requests containing query domains via Webhook, with support for basic authentication to secure the interface.
- Validate the input domain format and filter out illegal characters.
- Install and invoke the dig command from bind-tools to check if the domain has valid DNS servers.
- Determine whether the domain uses Cloudflare’s DNS services.
- If the domain is within the Cloudflare network, send a phishing alert email to the Cloudflare security mailbox.
- Regardless of Cloudflare usage, send an alert email to the official Steam security mailbox.
- Support retry and fault tolerance during processing to ensure stable workflow operation.
Involved Systems or Services
- n8n automation platform
- Webhook service (custom path and basic authentication)
- bind-tools command-line utility (dig command)
- Mailgun email service (for sending alert emails)
- Cloudflare security team mailbox (security@cloudflare.com)
- Official Steam security mailbox (security@valvesoftware.com)
Target Users and Value
- Cybersecurity analysts and automation engineers can quickly establish an automated phishing detection and reporting mechanism.
- Cloud security service providers can enhance their clients’ security response automation.
- Anti-phishing communities and security product developers can improve phishing threat detection and handling through automation.
- Enterprise security teams can monitor brand-related phishing risks and take timely protective measures.
This workflow integrates multi-layer verification and automated alerting to help users efficiently manage phishing domain risks and strengthen network security defenses.
Syncro to Clockify
This workflow automatically receives work order data from the Syncro system and synchronizes it in real-time with the Clockify time management platform, generating corresponding time entries. By streamlining data integration, it avoids the tediousness and errors of manual entry, thereby improving the efficiency and accuracy of work order time tracking. It is suitable for IT services, customer support, and project management teams, helping to enhance work efficiency and data consistency while optimizing operational processes.
Receive Updates When a New List Is Created in Affinity
This workflow listens for events related to newly created lists in the Affinity system, receiving update notifications in real-time. Users do not need to check manually, as they are immediately informed when a new list is created, significantly enhancing information synchronization efficiency. It is suitable for sales teams and customer managers, helping them to quickly respond to market changes and ensuring that the team is always up to date with the latest data dynamics, thereby reducing the risks associated with business delays and information lags.
OIDC Client Workflow
This workflow implements an automated client authentication process based on the OpenID Connect protocol, supporting the PKCE mechanism to enhance security. Users trigger the login through a Webhook, automatically completing the authorization code retrieval, access token exchange, and user information request, ultimately returning a personalized welcome page. This process is suitable for web applications or APIs that require third-party identity providers for single sign-on, ensuring that only successfully authenticated users can access protected content, thereby enhancing system security and user experience.
Automated FTP File Upload and Directory Listing Process
This workflow automates the FTP file upload and directory management process. After being manually triggered by the user, the system automatically downloads files from a specified URL and uploads them to a designated directory on the FTP server. Once the upload is complete, the system lists all the files in the FTP directory, ensuring that users can monitor the file status in real-time. This process simplifies file transfer operations, reduces human error, and improves work efficiency, making it suitable for operations personnel and development teams that need to regularly update and manage FTP files.
Monitor_security_advisories
This workflow automates the collection, filtering, and notification of security announcements. It regularly retrieves the latest security bulletins from Palo Alto Networks and intelligently filters information relevant to the organization's key products. By automatically creating tickets in Jira, it ensures that the security team can follow up in a timely manner. Additionally, important announcements are sent to relevant personnel via Gmail, enhancing the efficiency of information dissemination. This helps the organization establish an effective security risk management system, reduces the burden of manual monitoring, and accelerates response times.
Create a Channel, Invite Users to the Channel, Post a Message, and Upload a File
This workflow automates the creation of Slack channels, user invitations, sending welcome messages, and uploading files, significantly enhancing team collaboration efficiency. With a one-click trigger, users can quickly set up a communication environment, reducing time wasted and the risk of errors associated with manual operations. It is suitable for scenarios such as project initiation, onboarding new members, and file sharing, helping businesses optimize their internal communication processes.
URL Pinger
This workflow is designed to automatically check the status of multiple URLs at regular intervals, triggering every 15 minutes to send HTTP requests for monitoring link availability and response status. It supports continuous operation and is fault-tolerant, ensuring that the overall process is not interrupted even if individual requests fail. This feature is particularly suitable for website administrators, operations personnel, and content managers, helping them efficiently monitor website status, promptly identify issues, and enhance maintenance efficiency and service stability.
Zip Multiple Files
This workflow can automatically package and compress multiple different types of files (such as images, PDFs, Excel files, CSVs, etc.) into a single ZIP file, simplifying the management and transfer of multiple files. Its modular design enhances the efficiency of batch file processing, making it suitable for scenarios such as file uploads, email sending, and data backup, particularly for businesses or individual users who need to quickly organize and archive files. This solution effectively reduces the complexity of manual operations and improves work efficiency.