Nithish R. This workflow corresponds to n8n.io template #13774 — we link there as the canonical source.
This workflow follows the Google Sheets → HTTP Request recipe pattern — see all workflows that pair these two integrations.
The workflow JSON
Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →
{
"id": "47xmjh-XlURj1GFeJTbj2",
"name": "AI Fraud Detection & Budget Guard",
"tags": [],
"nodes": [
{
"id": "3124010c-d547-4e68-aa09-361e3f056342",
"name": "Webhook",
"type": "n8n-nodes-base.webhook",
"position": [
1296,
624
],
"parameters": {
"path": "tally-leads",
"options": {
"responseCode": {
"values": {}
}
},
"httpMethod": "POST"
},
"typeVersion": 2.1
},
{
"id": "d0a14915-7c05-42ef-bd14-24d4fdbdf2b4",
"name": "HTTP Request",
"type": "n8n-nodes-base.httpRequest",
"position": [
1712,
528
],
"parameters": {
"url": "https://ip-intelligence.abstractapi.com/v1",
"options": {},
"sendQuery": true,
"queryParameters": {
"parameters": [
{
"name": "api_key",
"value": "4229e19ddfdb4b1fb809ca8a24be8c7d"
},
{
"name": "ip_address",
"value": "223.178.80.56"
}
]
}
},
"typeVersion": 4.4
},
{
"id": "52aaaff3-6bfc-4696-a0a8-ab70b5256895",
"name": "Message a model",
"type": "@n8n/n8n-nodes-langchain.openAi",
"position": [
1648,
720
],
"parameters": {
"modelId": {
"__rl": true,
"mode": "list",
"value": "gpt-4o-mini",
"cachedResultName": "GPT-4O-MINI"
},
"options": {},
"responses": {
"values": [
{
"content": "=Name: {{ $json.body.data.fields[0].value }} | Message: {{ $json.body.data.fields[2].value }}"
},
{
"role": "system",
"content": "You are a Lead Quality Analyst. Analyze the following lead submission. If the message or name looks like gibberish, automated spam, or a bot script, return 'Spam'. If it looks like a real human, return 'Human'. Only provide the single-word result."
}
]
},
"builtInTools": {}
},
"typeVersion": 2.1
},
{
"id": "eab996cc-f466-49bf-b4f5-c8848b44709c",
"name": "Merge",
"type": "n8n-nodes-base.merge",
"position": [
2096,
624
],
"parameters": {
"mode": "combine",
"options": {},
"combineBy": "combineByPosition"
},
"typeVersion": 3.2
},
{
"id": "81a3e460-af8d-4403-84b4-9cd5bd34e27a",
"name": "If",
"type": "n8n-nodes-base.if",
"position": [
2304,
624
],
"parameters": {
"options": {
"ignoreCase": true
},
"conditions": {
"options": {
"version": 3,
"leftValue": "",
"caseSensitive": false,
"typeValidation": "loose"
},
"combinator": "or",
"conditions": [
{
"id": "b1d5cc00-2936-4807-8b32-401844f7d04f",
"operator": {
"name": "filter.operator.equals",
"type": "string",
"operation": "equals"
},
"leftValue": "={{ $json.security.is_vpn }}",
"rightValue": "true"
},
{
"id": "0af1b675-c0f3-40a9-a21c-aebe5c579b65",
"operator": {
"name": "filter.operator.equals",
"type": "string",
"operation": "equals"
},
"leftValue": "={{ $json.security.is_proxy }}",
"rightValue": "true"
},
{
"id": "95227f07-2839-4630-a902-e3e4de8fdf3b",
"operator": {
"name": "filter.operator.equals",
"type": "string",
"operation": "equals"
},
"leftValue": "={{ $json.output[0].content[0].text }}",
"rightValue": "spam"
}
]
},
"looseTypeValidation": true
},
"typeVersion": 2.3
},
{
"id": "16ae1e14-6b3d-47c7-a669-ce06df8ef816",
"name": "Verified Leads",
"type": "n8n-nodes-base.googleSheets",
"position": [
2576,
736
],
"parameters": {
"columns": {
"value": {},
"schema": [
{
"id": "Timestamp",
"type": "string",
"display": true,
"required": false,
"displayName": "Timestamp",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "Name",
"type": "string",
"display": true,
"required": false,
"displayName": "Name",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "Email",
"type": "string",
"display": true,
"required": false,
"displayName": "Email",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "IP Address",
"type": "string",
"display": true,
"required": false,
"displayName": "IP Address",
"defaultMatch": false,
"canBeUsedToMatch": true
}
],
"mappingMode": "defineBelow",
"matchingColumns": [],
"attemptToConvertTypes": false,
"convertFieldsToString": false
},
"options": {},
"operation": "append",
"sheetName": {
"__rl": true,
"mode": "list",
"value": 1699399720,
"cachedResultUrl": "https://docs.google.com/spreadsheets/d/1y_D0fU1cj7HbNMNtd9Lrezh5pvtMctxf4auHWcEeqGY/edit#gid=1699399720",
"cachedResultName": "Verified leads"
},
"documentId": {
"__rl": true,
"mode": "list",
"value": "1y_D0fU1cj7HbNMNtd9Lrezh5pvtMctxf4auHWcEeqGY",
"cachedResultUrl": "https://docs.google.com/spreadsheets/d/1y_D0fU1cj7HbNMNtd9Lrezh5pvtMctxf4auHWcEeqGY/edit?usp=drivesdk",
"cachedResultName": "Untitled spreadsheet"
}
},
"typeVersion": 4.7
},
{
"id": "5d573a1d-a730-43a2-91f3-d4cddc732a81",
"name": "Potential Spam",
"type": "n8n-nodes-base.googleSheets",
"position": [
2576,
544
],
"parameters": {
"columns": {
"value": {
"Name": "={{ $('Webhook').item.json.body.data.fields[0].value }}",
"Email": "={{ $('Webhook').item.json.body.data.fields[1].value }}",
"Status": "EXCLUDE / FRAUD",
"Timestamp": "={{ $('Webhook').item.json.body.data.createdAt }}",
"AI Verdict": "={{ $('Message a model').item.json.output[0].content[0].text }}",
"IP Address": "={{ $('Webhook').item.json.headers['cf-connecting-ip'] }}",
"Security Flags": "=VPN: {{ $node[\"HTTP Request\"].json.security.is_vpn }} | Proxy: {{ $node[\"HTTP Request\"].json.security.is_proxy }}"
},
"schema": [
{
"id": "Timestamp",
"type": "string",
"display": true,
"required": false,
"displayName": "Timestamp",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "Name",
"type": "string",
"display": true,
"required": false,
"displayName": "Name",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "Email",
"type": "string",
"display": true,
"required": false,
"displayName": "Email",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "IP Address",
"type": "string",
"display": true,
"required": false,
"displayName": "IP Address",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "AI Verdict",
"type": "string",
"display": true,
"removed": false,
"required": false,
"displayName": "AI Verdict",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "Security Flags",
"type": "string",
"display": true,
"removed": false,
"required": false,
"displayName": "Security Flags",
"defaultMatch": false,
"canBeUsedToMatch": true
},
{
"id": "Status",
"type": "string",
"display": true,
"removed": false,
"required": false,
"displayName": "Status",
"defaultMatch": false,
"canBeUsedToMatch": true
}
],
"mappingMode": "defineBelow",
"matchingColumns": [],
"attemptToConvertTypes": false,
"convertFieldsToString": false
},
"options": {},
"operation": "append",
"sheetName": {
"__rl": true,
"mode": "list",
"value": "gid=0",
"cachedResultUrl": "https://docs.google.com/spreadsheets/d/1y_D0fU1cj7HbNMNtd9Lrezh5pvtMctxf4auHWcEeqGY/edit#gid=0",
"cachedResultName": "Potential Spam"
},
"documentId": {
"__rl": true,
"mode": "list",
"value": "1y_D0fU1cj7HbNMNtd9Lrezh5pvtMctxf4auHWcEeqGY",
"cachedResultUrl": "https://docs.google.com/spreadsheets/d/1y_D0fU1cj7HbNMNtd9Lrezh5pvtMctxf4auHWcEeqGY/edit?usp=drivesdk",
"cachedResultName": "Untitled spreadsheet"
}
},
"typeVersion": 4.7
},
{
"id": "f03d3079-6841-4a7a-8184-dce81ff3b526",
"name": "Spam Alert",
"type": "n8n-nodes-base.slack",
"position": [
2784,
544
],
"parameters": {
"text": "Spam detected and neutralized!",
"user": {
"__rl": true,
"mode": "list",
"value": "U09LWJHPDB2",
"cachedResultName": "nithishx16"
},
"select": "user",
"otherOptions": {},
"authentication": "oAuth2"
},
"typeVersion": 2.4
},
{
"id": "7c7a67ed-9cc9-4e3e-b3e7-5ab641eb9b4c",
"name": "Sticky Note2",
"type": "n8n-nodes-base.stickyNote",
"position": [
1120,
176
],
"parameters": {
"color": 2,
"width": 416,
"height": 752,
"content": "This workflow serves as a security layer for your lead generation process, filtering out bot submissions and fraudulent IP addresses before they reach your CRM.\n\n## Step #1\nConfiguration Steps:\n\nTrigger: The workflow begins with a Webhook node. Copy the \"Production URL\" and paste it into your form provider's (e.g., Tally.so) Webhook settings.\n\nCaptured Data: The workflow is currently configured to parse headers for the connecting IP and body fields for \"Full Name\", \"Email Address\", and \"Message\".\n\nField Mapping: If your form uses different field labels, you must update the expressions in the Message a model and Google Sheets nodes to match your specific data structure."
},
"typeVersion": 1
},
{
"id": "3a0a185a-b2cf-4eb1-b655-50b506513123",
"name": "Sticky Note3",
"type": "n8n-nodes-base.stickyNote",
"position": [
1584,
176
],
"parameters": {
"color": 2,
"width": 416,
"height": 752,
"content": "## Step #2\nUpon receiving a lead, the workflow executes two parallel checks to maximize efficiency and accuracy.\n\nHTTP Request (IP Intelligence): This node queries AbstractAPI using the lead's IP address. It identifies technical red flags such as VPN usage, proxies, or connections originating from data centers rather than residential ISPs.\n\nMessage a model (AI Intent Analysis): Simultaneously, the lead's name and message are sent to GPT-4o-mini. The AI evaluates the content for non-human patterns, gibberish, or common spam scripts. It is instructed to return a binary verdict: \"Human\" or \"Ghost\"."
},
"typeVersion": 1
},
{
"id": "b31a6614-0211-4d37-938d-ed2eef1e972d",
"name": "Sticky Note4",
"type": "n8n-nodes-base.stickyNote",
"position": [
2048,
176
],
"parameters": {
"color": 2,
"width": 416,
"height": 752,
"content": "## Step #3\nMerge Node: This node waits for both the technical check and the AI analysis to finish. It combines the disparate data points into a single JSON object for final evaluation.\n\nIf Node (The Filter): This is the core decision engine. It uses \"OR\" logic to flag a lead if:\n\n1. The IP is identified as a VPN.\n2. The IP is identified as a Proxy.\n3. The AI returns a \"Spam\" verdict.\n\nIf any of these conditions are met, the lead is diverted to the security branch (Top). Otherwise, it proceeds to the verified branch (Bottom)."
},
"typeVersion": 1
},
{
"id": "08c64298-08d6-4808-8544-e6775f5fd88a",
"name": "Sticky Note5",
"type": "n8n-nodes-base.stickyNote",
"position": [
2512,
176
],
"parameters": {
"color": 2,
"width": 464,
"height": 752,
"content": "## Step #4\n### True Path (Potential Spam): \nFlagged leads are appended to the \"Potential Spam\" Google Sheet. This sheet acts as a master \"Blacklist\" which you should sync with your Google or Meta Ad Managers as an exclusion audience to prevent wasted retargeting spend.\n\nSpam Alert: A notification is sent to Slack to inform the team that a fraudulent submission was neutralized.\n\n### False Path (Verified Leads): \nLegitimate leads are saved to the \"Verified leads\" sheet for immediate sales follow-up."
},
"typeVersion": 1
},
{
"id": "432df446-897b-4c17-be7c-28cf5f798ffa",
"name": "Sticky Note6",
"type": "n8n-nodes-base.stickyNote",
"position": [
3024,
464
],
"parameters": {
"width": 464,
"height": 464,
"content": "## Google Sheets Schema Requirements:\n\n\n### Tab 1: Potential Spam\n\nName: The full name of the respondent.\nEmail: The email address used in the submission.\nIP Address: The network address captured by the webhook.\nAI Verdict: The output from the OpenAI analysis (Ghost/Spam).\nSecurity Flags: Details on VPN or Proxy status.\nTimestamp: The date and time the lead was intercepted.\n\n### Tab 2: Verified Leads\n\nName: The full name of the respondent.\nEmail: The email address.\nMessage: The core inquiry or message content.\nLocation: City and Country derived from the IP check.\nTimestamp: The date and time of submission."
},
"typeVersion": 1
},
{
"id": "28bc3878-87f0-4c5b-aca7-99b879f072b1",
"name": "Sticky Note7",
"type": "n8n-nodes-base.stickyNote",
"position": [
3024,
176
],
"parameters": {
"width": 464,
"height": 256,
"content": "## Requirements Checklist:\n\n### API Keys: \nYou must provide your own API keys for AbstractAPI and OpenAI within the respective node settings.\n\n### Authentication: \nEnsure your Google Sheets and Slack accounts are connected via the Credentials section."
},
"typeVersion": 1
},
{
"id": "b5c20a3a-0307-455f-bf41-c7e2e7338f52",
"name": "Sticky Note12",
"type": "n8n-nodes-base.stickyNote",
"position": [
624,
112
],
"parameters": {
"color": 5,
"width": 400,
"height": 368,
"content": "# Hello there!\n\n\n\n# Need support or have a workflow question? \n\n## \ud83d\udd17 [Connect on LinkedIn](https://www.linkedin.com/in/bynithish/)"
},
"typeVersion": 1
},
{
"id": "a3222dc1-5fe2-46fb-832f-070b04195b69",
"name": "Sticky Note",
"type": "n8n-nodes-base.stickyNote",
"position": [
1072,
112
],
"parameters": {
"color": 7,
"width": 2464,
"height": 896,
"content": ""
},
"typeVersion": 1
}
],
"active": false,
"settings": {
"binaryMode": "separate",
"availableInMCP": false,
"executionOrder": "v1"
},
"versionId": "5758f91b-f42f-4f6e-9d49-e15a96a3158f",
"connections": {
"If": {
"main": [
[
{
"node": "Potential Spam",
"type": "main",
"index": 0
}
],
[
{
"node": "Verified Leads",
"type": "main",
"index": 0
}
]
]
},
"Merge": {
"main": [
[
{
"node": "If",
"type": "main",
"index": 0
}
]
]
},
"Webhook": {
"main": [
[
{
"node": "HTTP Request",
"type": "main",
"index": 0
},
{
"node": "Message a model",
"type": "main",
"index": 0
}
]
]
},
"HTTP Request": {
"main": [
[
{
"node": "Merge",
"type": "main",
"index": 0
}
]
]
},
"Potential Spam": {
"main": [
[
{
"node": "Spam Alert",
"type": "main",
"index": 0
}
]
]
},
"Message a model": {
"main": [
[
{
"node": "Merge",
"type": "main",
"index": 1
}
]
]
}
}
}
Pro
For the full experience including quality scoring and batch install features for each workflow upgrade to Pro
About this workflow
This n8n template serves as a security layer for your marketing efforts, ensuring that only high-quality, human-verified leads reach your CRM while automatically blacklisting bots and VPN-based submissions.
Source: https://n8n.io/workflows/13774/ — original creator credit. Request a take-down →
Related workflows
Workflows that share integrations, category, or trigger type with this one. All free to copy and import.
This workflow automates the initial screening process for new job applications, freeing up your recruitment team to focus on qualified candidates. It receives applications from a webhook, uses OpenAI
HTTP Request, OpenAI, Google Sheets +2
This system meticulously guides each lead through a fully automated journey, from initial contact to a personalized follow-up and CRM integration.
OpenAI, @Elevenlabs/N8N Nodes Elevenlabs, Google Drive +4
Automate your landscaping business’s lead follow-up and booking with this AI-powered GoHighLevel workflow. Designed by Hyrum Hurst, AI Automation Engineer at QuarterSmart, this template takes every ne
OpenAI, HTTP Request, Google Calendar +2
A smart, fully automated coding pipeline built inside n8n that leverages Cursor AI to write, refactor, review, and optimize code projects — triggered by a webhook, schedule, or manual prompt. Every ou
HTTP Request, Google Drive, Google Sheets +2
Consulting firms in strategy, management, or IT who want to automate client onboarding and internal task assignment.
OpenAI, Google Sheets, Slack +3