{
  "name": "Brand Intelligence — Verify URL Belongs to Brand",
  "nodes": [
    {
      "parameters": {},
      "name": "Start",
      "type": "n8n-nodes-base.manualTrigger",
      "typeVersion": 1,
      "position": [240, 300],
      "id": "a1b2c3d4-1111-4aaa-bbbb-111111111111"
    },
    {
      "parameters": {
        "resource": "security",
        "method": "security.analyze_url",
        "params": "{ \"url\": \"https://bit.ly/example123\", \"brand\": \"yourbrand\" }",
        "product": "mediaapi"
      },
      "name": "Verify URL",
      "type": "n8n-nodes-mediavox.mediavox",
      "typeVersion": 2,
      "position": [480, 300],
      "credentials": {
        "mediavoxApi": {
          "name": "Mediavox API"
        }
      },
      "notes": "Resolves shortened URLs, checks Google Safe Browsing, validates domain age, detects typosquatting (homoglyphs), and verifies if the URL belongs to the specified brand. Set 'brand' to YOUR brand name.",
      "id": "a1b2c3d4-2222-4aaa-bbbb-222222222222"
    },
    {
      "parameters": {
        "conditions": {
          "options": {
            "caseSensitive": true,
            "leftValue": ""
          },
          "conditions": [
            {
              "id": "1",
              "leftValue": "={{ $json.data.verdict }}",
              "rightValue": "fraudulent",
              "operator": {
                "type": "string",
                "operation": "equals"
              }
            }
          ],
          "combinator": "and"
        },
        "options": {}
      },
      "name": "Is Phishing?",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2,
      "position": [720, 300],
      "id": "a1b2c3d4-3333-4aaa-bbbb-333333333333"
    },
    {
      "parameters": {
        "conditions": {
          "options": {
            "caseSensitive": true,
            "leftValue": "",
            "typeValidation": "loose"
          },
          "conditions": [
            {
              "id": "2",
              "leftValue": "={{ $json.data.brandValidation.matchesBrand }}",
              "rightValue": true,
              "operator": {
                "type": "boolean",
                "operation": "true"
              }
            }
          ],
          "combinator": "and"
        },
        "options": {}
      },
      "name": "Belongs to Brand?",
      "type": "n8n-nodes-base.if",
      "typeVersion": 2,
      "position": [720, 520],
      "id": "a1b2c3d4-4444-4aaa-bbbb-444444444444"
    },
    {
      "parameters": {
        "chatId": "YOUR_SECURITY_CHAT_ID",
        "text": "=PHISHING DETECTED\n\nURL: {{ $('Verify URL').item.json.data.url }}\nFinal Domain: {{ $('Verify URL').item.json.data.finalDomain }}\nVerdict: {{ $('Verify URL').item.json.data.verdict }}\nHomoglyph: {{ $('Verify URL').item.json.data.homoglyphDetected }}\nSafe Browsing: {{ $('Verify URL').item.json.data.safeBrowsingMalicious }}\n\nThis URL is impersonating your brand. Take action immediately."
      },
      "name": "Alert: Phishing Found",
      "type": "n8n-nodes-base.telegram",
      "typeVersion": 1,
      "position": [960, 200],
      "credentials": {
        "telegramApi": {
          "name": "Telegram Bot"
        }
      },
      "notes": "Replace chatId with your security team Telegram group.",
      "id": "a1b2c3d4-5555-4aaa-bbbb-555555555555"
    },
    {
      "parameters": {
        "values": {
          "string": [
            {
              "name": "status",
              "value": "=URL verified as OFFICIAL ({{ $('Verify URL').item.json.data.brandValidation.matchType }}). Domain: {{ $('Verify URL').item.json.data.finalDomain }}"
            }
          ]
        },
        "options": {}
      },
      "name": "Result: Official URL",
      "type": "n8n-nodes-base.set",
      "typeVersion": 3,
      "position": [960, 420],
      "id": "a1b2c3d4-6666-4aaa-bbbb-666666666666"
    },
    {
      "parameters": {
        "values": {
          "string": [
            {
              "name": "status",
              "value": "=URL NOT from brand. Domain: {{ $('Verify URL').item.json.data.finalDomain }}. Investigate further."
            }
          ]
        },
        "options": {}
      },
      "name": "Result: Unknown URL",
      "type": "n8n-nodes-base.set",
      "typeVersion": 3,
      "position": [960, 620],
      "id": "a1b2c3d4-7777-4aaa-bbbb-777777777777"
    }
  ],
  "connections": {
    "Start": {
      "main": [
        [{ "node": "Verify URL", "type": "main", "index": 0 }]
      ]
    },
    "Verify URL": {
      "main": [
        [
          { "node": "Is Phishing?", "type": "main", "index": 0 },
          { "node": "Belongs to Brand?", "type": "main", "index": 0 }
        ]
      ]
    },
    "Is Phishing?": {
      "main": [
        [{ "node": "Alert: Phishing Found", "type": "main", "index": 0 }],
        [{ "node": "Belongs to Brand?", "type": "main", "index": 0 }]
      ]
    },
    "Belongs to Brand?": {
      "main": [
        [{ "node": "Result: Official URL", "type": "main", "index": 0 }],
        [{ "node": "Result: Unknown URL", "type": "main", "index": 0 }]
      ]
    }
  },
  "settings": {
    "executionOrder": "v1"
  }
}