{"product_id":"phishing-email-analyzer-n8n-google-sheets-mcp-telegram","title":"Phishing Email Analyzer n8n: Google Sheets, MCP \u0026 Telegram","description":"\u003ch3\u003eCatch phishing faster: automated email analysis from Google Sheets to Telegram\u003c\/h3\u003e\n\u003cp\u003eThis n8n workflow monitors a Google Sheet for newly submitted phishing emails, downloads the linked \u003ccode\u003e.eml\u003c\/code\u003e\/\u003ccode\u003e.msg\u003c\/code\u003e files from Google Drive, analyzes headers and IOCs via an MCP server, and sends a clear maliciousness verdict and report directly to your Telegram chat.\u003c\/p\u003e\n\n\u003ch3\u003eWhat this workflow does\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003eTriggers every 5 minutes\u003c\/strong\u003e when a new row is added in Google Sheets.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eExtracts the Google Drive file ID\u003c\/strong\u003e from the sheet row link (expects an \u003ccode\u003eid=\u003c\/code\u003e parameter).\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eDownloads the email attachment\u003c\/strong\u003e from Google Drive and \u003cstrong\u003erejects submissions\u003c\/strong\u003e that aren’t \u003ccode\u003e.eml\u003c\/code\u003e or \u003ccode\u003e.msg\u003c\/code\u003e.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eParses the email\u003c\/strong\u003e to extract key headers, a cleaned body, embedded URLs, attachment metadata, and \u003cstrong\u003eSHA-256 hashes\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eValidates authentication and relay details\u003c\/strong\u003e by sending parsed data to an \u003cstrong\u003eMCP server\u003c\/strong\u003e that supports tools like \u003ccode\u003echeck_email_headers\u003c\/code\u003e and analyzes the \u003cstrong\u003eReceived\u003c\/strong\u003e chain for relay information.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eSplits extracted IOCs\u003c\/strong\u003e into URLs, hashes, and IPs, then performs reputation lookups via MCP tools such as \u003ccode\u003echeck_url\u003c\/code\u003e, \u003ccode\u003efile_hash\u003c\/code\u003e, and \u003ccode\u003elookup_ip\u003c\/code\u003e.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eMerges results\u003c\/strong\u003e and calculates an overall \u003cstrong\u003eMALICIOUS \/ SUSPICIOUS \/ LIKELY BENIGN\u003c\/strong\u003e verdict, formatting a plain-language report.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eSends the consolidated report to Telegram\u003c\/strong\u003e for fast triage.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eUse cases\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003eSecurity teams logging suspicious phishing submissions into a Google Sheet for automated triage.\u003c\/li\u003e\n  \u003cli\u003eSaaS operators reviewing customer-submitted phishing samples and receiving instant Telegram alerts.\u003c\/li\u003e\n  \u003cli\u003eAutomation engineers building repeatable phishing email analysis with n8n, MCP, and Telegram.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eTechnical details\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003eIntegrations\/nodes:\u003c\/strong\u003e code, merge, switch, \u003cstrong\u003eTelegram\u003c\/strong\u003e, sticky note, \u003cstrong\u003eGoogle Drive\u003c\/strong\u003e (with \u003cstrong\u003eGoogle Sheets\u003c\/strong\u003e trigger).\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eMCP server requirement:\u003c\/strong\u003e an endpoint supporting \u003ccode\u003echeck_email_headers\u003c\/code\u003e, \u003ccode\u003echeck_url\u003c\/code\u003e, \u003ccode\u003efile_hash\u003c\/code\u003e, and \u003ccode\u003elookup_ip\u003c\/code\u003e.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eCredentials:\u003c\/strong\u003e Google Sheets + Google Drive credentials, and a Telegram credential with configured chat ID.\u003c\/li\u003e\n\u003c\/ul\u003e","brand":"N8N Commerce","offers":[{"title":"Default Title","offer_id":45923037118643,"sku":"N8N-18899","price":38.99,"currency_code":"GBP","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0749\/6279\/6723\/files\/8lkjJJDjskSh2nT4bQJG-_slJrWLQS.png?v=1788167091","url":"https:\/\/buyflowscripts.com\/products\/phishing-email-analyzer-n8n-google-sheets-mcp-telegram","provider":"N8N Commerce","version":"1.0","type":"link"}