RelayShield node approved — breach monitoring, SIM swap detection, and live threat intel in n8n workflows

Built with n8n
1

Excited to share that n8n-nodes-relayshield has been approved as a verified node and is scheduled for inclusion in the next n8n release (within 14 days).

What it adds to your n8n toolkit — 7 operations in one node:

  1. Breach Check — email breach exposure
  2. Infostealer Check — credential exposure in criminal log markets
  3. SIM Swap Detection — carrier-level port-out detection
  4. Domain Lookalike Scan — typosquat and homoglyph detection
  5. OAuth Watchlist Check — supply chain exposure via OAuth authorizations
  6. Threat Intelligence — IOC Lookup (domain, IP, email, phone, wallet)
  7. Threat Intelligence — CVE Lookup (CISA KEV by CVE ID or keyword)

Example workflow:
Schedule → RelayShield Breach Check (employee email) → IF breach_count > 0 → RelayShield Infostealer Check → IF exposed → Gmail/Slack alert

Credentials: Just your RelayShield API key. Test connection is built in.

You can install it now via community nodes (search n8n-nodes-relayshield) or npm. Will appear in the native node library within 14 days.

API docs + free tier: RelayShield API — Security Intelligence for Developers

Happy to help anyone build workflows around it.

1 Like
2

Here’s a starter workflow you can import directly: Schedule trigger → breach check on an employee email → if exposed, run an infostealer check and sends a Slack alert:

{
“nodes”: [
{
“name”: “Schedule Trigger”,
“type”: “n8n-nodes-base.scheduleTrigger”,
“parameters”: { “rule”: { “interval”: [{ “field”: “days”, “daysInterval”: 1 }] } },
“position”: [240, 300]
},
{
“name”: “Breach Check”,
“type”: “n8n-nodes-relayshield.relayShield”,
“parameters”: {
“operation”: “breach”,
“email”: “={{ $json.email }}”
},
“position”: [460, 300]
},
{
“name”: “Exposed?”,
“type”: “n8n-nodes-base.if”,
“parameters”: {
“conditions”: {
“number”: [{ “value1”: “={{ $json.breach_count }}”, “operation”: “larger”, “value2”: 0 }]
}
},
“position”: [680, 300]
},
{
“name”: “Infostealer Check”,
“type”: “n8n-nodes-relayshield.relayShield”,
“parameters”: {
“operation”: “infostealer”,
“email”: “={{ $(‘Breach Check’).item.json.email }}”
},
“position”: [900, 220]
},
{
“name”: “Slack Alert”,
“type”: “n8n-nodes-base.slack”,
“parameters”: {
“operation”: “message”,
“channel”: “#general”,
“text”: “=:warning: Breach detected: {{ $(‘Breach Check’).item.json.email }} — {{ $json.infostealer_exposed ? ‘also in infostealer logs’ : ‘not in infostealer logs’ }}”
},
“position”: [1120, 220]
}
]
}

Import via Menu → Import from JSON. Add your RelayShield API key in the credentials panel and swap in your email source node. Happy to share more workflow patterns.

3

The OAuth Watchlist Check and Domain Lookalike Scan are the standout ones for me - those are two checks I’d normally have to wire together manually from separate APIs. A solid combo for this node would be pairing it with an HR offboarding trigger: when an employee is deactivated, run Breach Check + Infostealer Check on their work email and pipe the results into a Notion or Slack security log automatically.

1 Like
4

Exactly the use case we had in mind for those two. The offboarding trigger is a great pattern —> deactivated employee email + breach/infostealer check + log to Notion is maybe a 4-node workflow. If you build it, share it here. Happy to feature it in our docs as a community workflow example.