Automation library · Setup and learning

Investigate phishing emails from Google Sheets with MCP

Started by a change in a Google Sheet, and works across Google Drive, Google Sheets and Telegram. 13 steps, 1 branch: a working afternoon to understand properly.

Medium

13 stepsMedium: a working afternoon
1Branch: places the flow splits
0Loops or waits
3Services it connects to

The flow

Starts it 1Model 4Logic 6Service 2

The steps in the order they run, from what starts it.

  1. 1Google Sheets TriggerGoogle Sheets triggerStarts it
  2. 2Download fileGoogle DriveService
  3. 3Code in JavaScriptCodeLogic
  4. 4Code in PythonCodeLogic
  5. 5MCP ClientMcp ClientModel
  6. 6Split IOCsCodeLogic
  7. 7Merge ResultsMergeLogic
  8. 8Switch IOC TypeSwitchLogic
  9. 9Build ReportCodeLogic
  10. 10Check URLMcp ClientModel
  11. 11Check HashMcp ClientModel
  12. 12Check IPMcp ClientModel
  13. 13Notify TelegramTelegramService

How it's built

Starts on
A change in a Google Sheet
Steps
13, with 1 branch
Size
Medium: a working afternoon
Connects to
Google Drive, Google Sheets, Telegram
Model
None. This is plumbing, not judgement

Questions

What does it need to run?

An n8n account, plus your own Google Drive, Google Sheets and Telegram accounts. You connect your own accounts after importing it; none are included.

What starts it?

It starts on a change in a Google Sheet.

Does it use AI?

No. Every step is fixed logic or a call to a service, so it does the same thing every time.

How long does it take to set up?

Plan an afternoon. 13 steps is enough that you should read each one before running it.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

Before you run it

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 13 steps before you point it at anything that matters.