Phishing Email Analyzer n8n: Google Sheets, MCP & Telegram

Catch phishing faster: automated email analysis from Google Sheets to Telegram

This n8n workflow monitors a Google Sheet for newly submitted phishing emails, downloads the linked .eml/.msg files from Google Drive, analyzes headers and IOCs via an MCP server, and sends a clear maliciousness verdict and report directly to your Telegram chat.

What this workflow does

• Triggers every 5 minutes when a new row is added in Google Sheets.
• Extracts the Google Drive file ID from the sheet row link (expects an id= parameter).
• Downloads the email attachment from Google Drive and rejects submissions that aren’t .eml or .msg.
• Parses the email to extract key headers, a cleaned body, embedded URLs, attachment metadata, and SHA-256 hashes.
• Validates authentication and relay details by sending parsed data to an MCP server that supports tools like check_email_headers and analyzes the Received chain for relay information.
• Splits extracted IOCs into URLs, hashes, and IPs, then performs reputation lookups via MCP tools such as check_url, file_hash, and lookup_ip.
• Merges results and calculates an overall MALICIOUS / SUSPICIOUS / LIKELY BENIGN verdict, formatting a plain-language report.
• Sends the consolidated report to Telegram for fast triage.

Use cases

• Security teams logging suspicious phishing submissions into a Google Sheet for automated triage.
• SaaS operators reviewing customer-submitted phishing samples and receiving instant Telegram alerts.
• Automation engineers building repeatable phishing email analysis with n8n, MCP, and Telegram.

Technical details

• Integrations/nodes: code, merge, switch, Telegram, sticky note, Google Drive (with Google Sheets trigger).
• MCP server requirement: an endpoint supporting check_email_headers, check_url, file_hash, and lookup_ip.
• Credentials: Google Sheets + Google Drive credentials, and a Telegram credential with configured chat ID.