# Catch a blocklisted domain before your customers do > Every weekday, check your domains for new blocklist flags, log results in your spreadsheet, and get a Slack alert only when something gets worse. - Workflow type: code - Services: VirusTotal, Google Sheets, Slack Bot - Categories: Operations, Marketing - Published: 2026-08-10 ## What it does - Reads your domain watchlist straight from the Google Sheet your team already maintains, one domain per row. - Checks every domain against 70+ security and blocklist vendors each weekday morning. - Writes the fresh verdict, the number of vendors flagging the domain, and the time of the check back into the same sheet. - Posts a Slack alert naming the domain, the vendors that flagged it, and how the numbers changed. Stays completely silent when nothing has changed. ## What you'll need - A VirusTotal account. The free plan is enough for a watchlist of up to about 100 domains. - A Google Sheet with one row per domain, plus columns for the last verdict, the number of flagging vendors, and the date of the last check. - A Slack workspace and the channel where your operations team wants alerts to land. ## Prompt Every weekday at 7am, run a reputation health check across the domains we own and depend on, so that we find out we have been blocklisted before our customers tell us. Every step is deterministic: read rows, one lookup per row, compare against the stored verdict, write back, alert on a threshold. Start by reading the watchlist from our Google Sheets tab using Get Values, over a range that covers the whole table. Each row holds one domain plus the state left behind by the previous run. The layout is: column A the domain, column B the last known verdict, column C the last known malicious engine count, and column D the date and time of the last check. Skip the header row, and skip any row whose domain cell is blank. For each domain in the list, call the VirusTotal Get a Domain Report operation with the bare domain as the identifier. Read the engine counts from attributes.last_analysis_stats, specifically the harmless, malicious, and suspicious values. To be able to name individual vendors in the alert, also read attributes.last_analysis_results and collect every engine whose category is malicious or suspicious, keeping both the engine name and the result label it returned. Derive a fresh verdict for each domain from those counts: malicious when the malicious count is 1 or more, suspicious when the malicious count is 0 but the suspicious count is 1 or more, and clean when both are 0. Rank verdicts in severity order clean, then suspicious, then malicious, so the fresh verdict can be compared against the value already recorded in the sheet. Pace the per-domain loop. A free VirusTotal key allows only 4 requests per minute and 500 per day, so wait about 16 seconds between domain lookups and keep the watchlist to roughly 100 domains. If a lookup comes back rate limited, back off and retry that domain rather than dropping it. If a lookup returns not found, the domain is simply not in VirusTotal yet: record the verdict as unknown, still update the timestamp, and do not treat it as a detection. Write the results back into the same sheet with Update Values: the fresh verdict into the verdict column, the malicious engine count into the count column, and the current date and time into the last checked column. Always write the timestamp for every domain that was checked, even when nothing changed, so we can tell the difference between a domain that is genuinely clean and a domain the workflow failed to reach. Alert only when something is actually wrong. A domain qualifies if one or more engines now flag it as malicious or suspicious, or if its fresh verdict is worse than the verdict already recorded in the sheet. For every qualifying domain, use the Slack Bot Send a Message operation to post to our operations channel, naming the domain, the specific engines that flagged it along with the label each one returned, and the before and after values for both the verdict and the malicious engine count. Include a link to the domain's VirusTotal report so someone can dig in immediately. Group all qualifying domains into a single message rather than sending one message per domain, because Slack throttles repeated posts to the same channel. When nothing has changed, stay completely silent. If every domain comes back clean and no verdict is worse than what the sheet recorded, do not post to Slack at all. The only side effect of a quiet run is the refreshed set of timestamps in the sheet. ## How to customize - Change the schedule: run it daily including weekends, twice a day, or only on Monday mornings. - Change who hears about it: point alerts at a different Slack channel, or split marketing domains and infrastructure domains into separate channels. - Change the alert threshold: speak up on a single vendor flag, or stay quiet until several vendors agree. ## Example output :rotating_light: Domain reputation change detected mail.acme-marketing.com Verdict: clean -> malicious Flagging engines: 3 (was 0) Flagged by: Google Safebrowsing (phishing), Sophos (malware), BitDefender (malware) Report: https://www.virustotal.com/gui/domain/mail.acme-marketing.com links.acme-marketing.com Verdict: clean -> suspicious Flagging engines: 0 malicious, 1 suspicious (was 0) Flagged by: Forcepoint ThreatSeeker (suspicious) Report: https://www.virustotal.com/gui/domain/links.acme-marketing.com 2 of 34 watchlist domains changed. Full history in the Domain Watchlist sheet. ## FAQ ### Will this work with a free VirusTotal account? Yes. The free plan allows 4 checks a minute and 500 a day, so the workflow paces itself between domains. A watchlist of up to about 100 domains fits comfortably. Larger portfolios need a paid plan or a split schedule. ### Will it fill our channel with noise every morning? No. It only posts when a domain is actively flagged or when its verdict is worse than what your sheet already recorded. On a quiet day it silently refreshes the timestamps and says nothing at all. ### Which domains should go on the watchlist? The ones whose reputation you cannot afford to lose: your main website, your email sending domains, your landing page and link tracking domains, and any client domains you manage on their behalf. ### Do we need a security team to use this? No. It is built for webmasters, marketing ops, and agencies. A blocklisted domain quietly destroys email deliverability and ad approvals, and this tells you first. ### What if a domain is brand new and not known yet? It gets recorded as unknown and its timestamp still updates, but no alert fires. That way a freshly registered domain will not create a false alarm. Use this prompt in General Input: https://www.generalinput.com/prompts/catch-a-blocklisted-domain-before-your-customers-do