{
  "name": "Steam + CF Report",
  "nodes": [
    {
      "name": "Webhook",
      "type": "n8n-nodes-base.webhook",
      "position": [
        110,
        200
      ],
      "parameters": {
        "path": "steam",
        "responseData": "allEntries",
        "responseMode": "lastNode",
        "authentication": "basicAuth"
      },
      "credentials": {
        "httpBasicAuth": "credentials"
      },
      "retryOnFail": false,
      "typeVersion": 1
    },
    {
      "name": "Add bind-tools",
      "type": "n8n-nodes-base.executeCommand",
      "color": "#FF8000",
      "notes": "Install bind-tools",
      "position": [
        480,
        180
      ],
      "parameters": {
        "command": "=which dig || apk add bind-tools"
      },
      "retryOnFail": true,
      "typeVersion": 1,
      "continueOnFail": true,
      "waitBetweenTries": 1000
    },
    {
      "name": "dig check CF",
      "type": "n8n-nodes-base.executeCommand",
      "color": "#FF8000",
      "notes": "Install bind-tools",
      "position": [
        1300,
        -50
      ],
      "parameters": {
        "command": "=dig NS  {{$node[\"Webhook\"].data[\"query\"][\"q\"]}} +short | grep cloudflare.com.$ | wc -l"
      },
      "retryOnFail": true,
      "typeVersion": 1,
      "continueOnFail": true,
      "waitBetweenTries": 1000
    },
    {
      "name": "IF",
      "type": "n8n-nodes-base.if",
      "position": [
        1550,
        -50
      ],
      "parameters": {
        "conditions": {
          "number": [
            {
              "value1": "= {{$node[\"dig check CF\"].data[\"stdout\"]}}",
              "operation": "larger"
            }
          ]
        }
      },
      "typeVersion": 1
    },
    {
      "name": "Mail CloudFlare",
      "type": "n8n-nodes-base.mailgun",
      "position": [
        1830,
        160
      ],
      "parameters": {
        "text": "=Hello,\n\nI am emailing you to let you know about a Steam phishing website on your network: {{$node[\"Webhook\"].data[\"query\"][\"q\"]}}.\n\nThank you,\nYour Name Here",
        "ccEmail": "yourCCemail",
        "subject": "={{$node[\"Webhook\"].data[\"query\"][\"q\"]}} - Steam Phishing Website on your network",
        "toEmail": "security@cloudflare.com",
        "fromEmail": "yourFROMemail"
      },
      "credentials": {
        "mailgunApi": "Mailgun"
      },
      "typeVersion": 1
    },
    {
      "name": "Mail Steam",
      "type": "n8n-nodes-base.mailgun",
      "position": [
        1830,
        340
      ],
      "parameters": {
        "text": "=Hello,\n\nI am emailing you to let you know about a Steam phishing website: {{$node[\"Webhook\"].data[\"query\"][\"q\"]}}.\n\nThank you,\nYour Name Here",
        "ccEmail": "yourCCemail",
        "subject": "={{$node[\"Webhook\"].data[\"query\"][\"q\"]}} - Steam Phishing Website",
        "toEmail": "security@valvesoftware.com",
        "fromEmail": "yourFROMemail"
      },
      "credentials": {
        "mailgunApi": "Mailgun"
      },
      "typeVersion": 1
    },
    {
      "name": "dig check if domain is valid",
      "type": "n8n-nodes-base.executeCommand",
      "color": "#FF8000",
      "notes": "Install bind-tools",
      "position": [
        720,
        180
      ],
      "parameters": {
        "command": "=dig NS  {{$node[\"Webhook\"].data[\"query\"][\"q\"]}} +short | wc -l"
      },
      "retryOnFail": true,
      "typeVersion": 1,
      "continueOnFail": true,
      "waitBetweenTries": 1000
    },
    {
      "name": "If it has nameservers",
      "type": "n8n-nodes-base.if",
      "position": [
        970,
        180
      ],
      "parameters": {
        "conditions": {
          "number": [
            {
              "value1": "= {{$node[\"dig check if domain is valid\"].data[\"stdout\"]}}",
              "operation": "larger"
            }
          ]
        }
      },
      "typeVersion": 1
    },
    {
      "name": "IF1",
      "type": "n8n-nodes-base.if",
      "position": [
        270,
        200
      ],
      "parameters": {
        "conditions": {
          "string": [
            {
              "value1": "={{$node[\"Webhook\"].data[\"query\"][\"q\"]}}",
              "value2": "/^[a-zA-Z0-9-_.]+$/",
              "operation": "regex"
            }
          ]
        }
      },
      "typeVersion": 1
    }
  ],
  "active": false,
  "settings": {},
  "connections": {
    "IF": {
      "main": [
        [
          {
            "node": "Mail CloudFlare",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF1": {
      "main": [
        [
          {
            "node": "Add bind-tools",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Webhook": {
      "main": [
        [
          {
            "node": "IF1",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "dig check CF": {
      "main": [
        [
          {
            "node": "IF",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Add bind-tools": {
      "main": [
        [
          {
            "node": "dig check if domain is valid",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "If it has nameservers": {
      "main": [
        [
          {
            "node": "dig check CF",
            "type": "main",
            "index": 0
          },
          {
            "node": "Mail Steam",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "dig check if domain is valid": {
      "main": [
        [
          {
            "node": "If it has nameservers",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}