Catch a blocklisted domain before your customers do

Every weekday at 7am, run a reputation health check across the domains we own and depend on, so that we find out we have been blocklisted before our customers tell us. Every step is deterministic: read rows, one lookup per row, compare against the stored verdict, write back, alert on a threshold.

Start by reading the watchlist from our Google Sheets tab using Get Values, over a range that covers the whole table. Each row holds one domain plus the state left behind by the previous run. The layout is: column A the domain, column B the last known verdict, column C the last known malicious engine count, and column D the date and time of the last check. Skip the header row, and skip any row whose domain cell is blank.

For each domain in the list, call the VirusTotal Get a Domain Report operation with the bare domain as the identifier. Read the engine counts from attributes.last_analysis_stats, specifically the harmless, malicious, and suspicious values. To be able to name individual vendors in the alert, also read attributes.last_analysis_results and collect every engine whose category is malicious or suspicious, keeping both the engine name and the result label it returned.

Derive a fresh verdict for each domain from those counts: malicious when the malicious count is 1 or more, suspicious when the malicious count is 0 but the suspicious count is 1 or more, and clean when both are 0. Rank verdicts in severity order clean, then suspicious, then malicious, so the fresh verdict can be compared against the value already recorded in the sheet.

Pace the per-domain loop. A free VirusTotal key allows only 4 requests per minute and 500 per day, so wait about 16 seconds between domain lookups and keep the watchlist to roughly 100 domains. If a lookup comes back rate limited, back off and retry that domain rather than dropping it. If a lookup returns not found, the domain is simply not in VirusTotal yet: record the verdict as unknown, still update the timestamp, and do not treat it as a detection.

Write the results back into the same sheet with Update Values: the fresh verdict into the verdict column, the malicious engine count into the count column, and the current date and time into the last checked column. Always write the timestamp for every domain that was checked, even when nothing changed, so we can tell the difference between a domain that is genuinely clean and a domain the workflow failed to reach.

Alert only when something is actually wrong. A domain qualifies if one or more engines now flag it as malicious or suspicious, or if its fresh verdict is worse than the verdict already recorded in the sheet. For every qualifying domain, use the Slack Bot Send a Message operation to post to our operations channel, naming the domain, the specific engines that flagged it along with the label each one returned, and the before and after values for both the verdict and the malicious engine count. Include a link to the domain's VirusTotal report so someone can dig in immediately. Group all qualifying domains into a single message rather than sending one message per domain, because Slack throttles repeated posts to the same channel.

When nothing has changed, stay completely silent. If every domain comes back clean and no verdict is worse than what the sheet recorded, do not post to Slack at all. The only side effect of a quiet run is the refreshed set of timestamps in the sheet.