Hunt Brand Impersonation and Deepfake Threats with Claude, Google Sheets and…

The workflow JSON

Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →

{
  "id": "K1ZcNcrjYBGQ1dQD",
  "meta": {
    "templateCredsSetupCompleted": true
  },
  "name": "Brand-Impersonation & Deepfake Hunter",
  "tags": [],
  "nodes": [
    {
      "id": "4d57b96a-d20d-4eec-a224-524b384dfd53",
      "name": "Sticky Note - Overview",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        0,
        0
      ],
      "parameters": {
        "width": 1040,
        "height": 1472,
        "content": "## Brand-Impersonation & Deepfake Hunter\n\nThis workflow continuously hunts for fake accounts, cloned logos, and AI-voice scams using your brand \u2014 scanning on a schedule, scoring every candidate account it finds, and escalating the genuinely dangerous ones instead of burying your team in noise.\n\nThe threat score is deliberately NOT left entirely to the AI. Account age, follower reach, and profile-image similarity are combined in code with the AI's own risk assessment into a single composite 0-100 threat score, so the number behind every escalation is explainable and reproducible. AI is used where it adds real value: judging whether a given account is actually impersonating the brand (versus a fan account, a press mention, or an unrelated namesake) and classifying what kind of threat it is.\n\n### Who's it for\n- Brand protection, trust & safety, and legal teams monitoring for impersonation at scale\n- Marketing and social teams who want fake \"customer support\" and giveaway-scam accounts caught before customers fall for them\n- Companies that have had executives impersonated via AI-voice or deepfake scams and need continuous, not one-off, monitoring\n- Anyone replacing manual searching of platforms for lookalike accounts with an automated, repeatable scan\n\n### How it works\n1. A schedule trigger runs the scan continuously (default: every 4 hours), pulling in the brand's official handles, domains, logo description, and known scam patterns\n2. Code builds a batch of monitoring queries: the brand's own keywords plus a set of common typosquat and impersonation-style handle variants, across every platform being monitored\n3. A brand-monitoring / social-listening API is queried with that batch and returns candidate accounts and mentions to review\n4. AI reviews each candidate against the real brand's identity and known scam patterns, judging whether it's actually impersonation, what type (fake account, cloned logo, AI-voice scam report, phishing, counterfeit listing), and why \u2014 while staying conservative about flagging genuine fans or press mentions\n5. Code combines that judgment with account age, follower reach, and visual-similarity signals into a composite threat score and priority tier, and flags any AI-voice scam report as inherently urgent regardless of reach\n6. Every scanned candidate is logged to Google Sheets, building a running history of impersonation activity over time\n7. Scans that surface a Critical-tier threat, or any AI-voice scam report, trigger an immediate alert email to the brand-protection team; routine scans are simply logged\n\n### How to set up\n1. Import this workflow into n8n\n2. Add Anthropic Claude credentials and attach to the Anthropic model node\n3. Replace YOUR-BRAND-MONITORING-API.example.com and YOUR_BRAND_MONITORING_API_KEY with your real social-listening / search API (e.g. a platform-specific API, a search API, or a dedicated brand-protection service)\n4. Add SendGrid credentials and replace YOUR_SENDGRID_API_KEY in the alert email node\n5. Replace brand-protection@meridiantravel.example.com with your real team address\n6. Switch the Google Sheets HTTP node to the native Google Sheets node with OAuth2, or add OAuth2 credentials directly\n7. Replace YOUR_SHEET_ID with your actual Spreadsheet ID\n8. Set up your Google Sheet with an ImpersonationScans tab (column layout below)\n9. Adjust the schedule trigger interval to match how often you want to scan, then activate\n\n### Requirements\n- Anthropic Claude API key (claude-sonnet-4 recommended)\n- A brand-monitoring / social-listening or search API covering the platforms you care about\n- SendGrid API key for email delivery\n- Google Sheets with OAuth2 credentials (ImpersonationScans tab)\n\n### How to customize\n- Adjust the reach, new-account, and visual-similarity weightings in JS - Calculate Aggregate Threat Score & Format Alert Record to match how much you weigh follower count vs. account age vs. logo cloning\n- Add or remove monitored platforms and typosquat rules in JS - Build Brand Monitoring Query Batch\n- Raise or lower the Critical-tier escalation threshold in JS - Calculate Aggregate Threat Score & Format Alert Record (default: composite score >= 80)\n- Feed confirmed takedown outcomes back into the sheet so you can track platform response times over time\n\n### Important note\nThis workflow flags likely impersonation for a human brand-protection or legal team to confirm and act on \u2014 it does not file takedown requests or contact platforms automatically. Confirm any account before reporting it, and keep a human in the loop before any cease-and-desist or legal action.\n\n### Google Sheets Column Layout\n\nImpersonationScans tab - row 1 headers:\nScan ID | Platform | Account Handle | Impersonation Type | Threat Score | Priority Tier | Recommended Action | Red Flags | Scanned At"
      },
      "typeVersion": 1
    },
    {
      "id": "2132651a-aed9-4143-868c-5a447f9d1f2e",
      "name": "Sticky Note - Stage 1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1120,
        496
      ],
      "parameters": {
        "color": 3,
        "width": 1084,
        "height": 780,
        "content": "## Stage 1: Scheduled Scan, Query Build & Candidate Fetch\n\nThe schedule trigger runs continuously (default: every 4 hours) so monitoring never stops. Set - Prepare Brand Protection Context holds the brand's official handles, domains, logo description, executive names, and known scam patterns, with sensible defaults so the workflow can be tested without configuration.\n\nJS - Build Brand Monitoring Query Batch is pure code, not AI: it takes the brand's keywords and generates common typosquat / impersonation-style handle variants (character substitutions, added \"official\"/\"support\" suffixes, dropped letters), then builds one query per keyword and variant across every monitored platform.\n\nFetch Candidate Brand Mentions & Accounts sends that query batch to a brand-monitoring or social-listening API and returns the candidate accounts and mentions found this scan for AI review."
      },
      "typeVersion": 1
    },
    {
      "id": "cc4b1017-fe2d-4991-89f3-893648754be8",
      "name": "Sticky Note - Stage 2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        2240,
        528
      ],
      "parameters": {
        "color": 3,
        "width": 924,
        "height": 780,
        "content": "## Stage 2: AI Impersonation Review & Threat Scoring\n\nA Wait buffer respects API rate limits before this call.\n\nThe impersonation-review AI (claude-sonnet-4, temperature 0.2 for accuracy) judges each candidate account against the real brand's identity and known scam patterns: is it actually impersonation, what type of threat is it, and why \u2014 staying conservative so genuine fans, press coverage, or unrelated namesakes aren't flagged.\n\nJS - Parse Impersonation Classification Output extracts that JSON with a fallback that flags every unparsed candidate for manual review rather than silently clearing it.\n\nJS - Calculate Aggregate Threat Score & Format Alert Record is pure code: it combines the AI's risk score with account age, follower reach, and profile-image similarity into a composite 0-100 threat score and priority tier, treats any AI-voice scam report as inherently urgent, and builds the summary rows for the tracker sheet."
      },
      "typeVersion": 1
    },
    {
      "id": "a973dfe3-d15b-4455-af76-6b80e69abae4",
      "name": "Sticky Note - Stage 3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        3200,
        304
      ],
      "parameters": {
        "color": 3,
        "width": 732,
        "height": 1066,
        "content": "## Stage 3: Logging & Escalation\n\nSave Scan Results to Google Sheets Tracker appends one row per flagged candidate \u2014 every scan is logged, regardless of outcome, building a running impersonation history for the brand.\n\nIF - Escalation Required branches on whether any candidate this scan hit a Critical priority tier or was classified as an AI-voice scam report:\n- Escalation required: a Wait buffer respects downstream email rate limits, then Send Critical Impersonation Alert Email gives the brand-protection team the top threats, their risk scores, red flags, and recommended actions, for immediate human review.\n"
      },
      "typeVersion": 1
    },
    {
      "id": "9a949364-490e-426c-9268-566eb3255aa2",
      "name": "Schedule Trigger - Continuous Brand Scan",
      "type": "n8n-nodes-base.scheduleTrigger",
      "position": [
        1184,
        928
      ],
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "hours",
              "hoursInterval": 4
            }
          ]
        }
      },
      "typeVersion": 1.2
    },
    {
      "id": "0c3250e1-b614-4328-b639-54841b6f1404",
      "name": "Set - Prepare Brand Protection Context",
      "type": "n8n-nodes-base.set",
      "position": [
        1408,
        928
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": [
            {
              "name": "brandName",
              "type": "string",
              "value": "={{ $json.brandName || 'Meridian Travel Co' }}"
            },
            {
              "name": "officialDomains",
              "type": "string",
              "value": "={{ $json.officialDomains || 'meridiantravel.com, meridiantravel.co' }}"
            },
            {
              "name": "officialSocialHandlesJson",
              "type": "string",
              "value": "={{ $json.officialSocialHandlesJson || '{\"instagram\":\"@meridiantravelco\",\"facebook\":\"MeridianTravelCo\",\"twitter\":\"@MeridianTravel\",\"tiktok\":\"@meridiantravelco\"}' }}"
            },
            {
              "name": "brandKeywords",
              "type": "string",
              "value": "={{ $json.brandKeywords || 'Meridian Travel, MeridianTravel, Meridian Travel Co' }}"
            },
            {
              "name": "logoDescription",
              "type": "string",
              "value": "={{ $json.logoDescription || 'Navy blue compass rose icon beside a bold serif \"MERIDIAN\" wordmark' }}"
            },
            {
              "name": "executiveNames",
              "type": "string",
              "value": "={{ $json.executiveNames || 'Elena Marsh (CEO), Raj Patel (Head of Partnerships)' }}"
            },
            {
              "name": "knownScamPatterns",
              "type": "string",
              "value": "={{ $json.knownScamPatterns || 'Fake giveaway DMs promising free trips, cloned customer-support accounts requesting payment via gift cards, AI-voice calls impersonating executives requesting wire transfers' }}"
            },
            {
              "name": "monitoringPlatformsCsv",
              "type": "string",
              "value": "={{ $json.monitoringPlatformsCsv || 'Instagram, Facebook, TikTok, Twitter/X, General Web' }}"
            },
            {
              "name": "alertEmail",
              "type": "string",
              "value": "={{ $json.alertEmail || 'brand-protection@meridiantravel.example.com' }}"
            },
            {
              "name": "scanStartedAt",
              "type": "string",
              "value": "={{ new Date().toISOString() }}"
            },
            {
              "name": "scanId",
              "type": "string",
              "value": "={{ 'SCAN-' + Date.now().toString().slice(-8) }}"
            }
          ]
        }
      },
      "typeVersion": 3.4
    },
    {
      "id": "51b09326-95ef-4897-9546-fe4cf7eaf4ba",
      "name": "JS - Build Brand Monitoring Query Batch",
      "type": "n8n-nodes-base.code",
      "position": [
        1632,
        928
      ],
      "parameters": {
        "mode": "runOnceForEachItem",
        "jsCode": "const item = $input.item.json;\n\nconst platforms = (item.monitoringPlatformsCsv || '').split(',').map(p => p.trim()).filter(Boolean);\nconst keywords = (item.brandKeywords || '').split(',').map(k => k.trim()).filter(Boolean);\n\n// Generate common typosquat / impersonation-style handle variants for each keyword\nfunction buildVariants(keyword) {\n  const base = keyword.toLowerCase().replace(/[^a-z0-9]/g, '');\n  if (!base) return [];\n  return Array.from(new Set([\n    base,\n    base + 'official',\n    base + 'support',\n    base + '_help',\n    base.replace(/o/g, '0'),\n    base.length > 1 ? base.slice(0, -1) : base,\n    base + '1'\n  ]));\n}\n\nlet handleVariants = [];\nkeywords.forEach(k => {\n  handleVariants = handleVariants.concat(buildVariants(k));\n});\nhandleVariants = Array.from(new Set(handleVariants));\n\nconst monitoringQueries = [];\nplatforms.forEach(platform => {\n  keywords.forEach(keyword => {\n    monitoringQueries.push({ platform, queryText: keyword, queryType: 'keyword' });\n  });\n  handleVariants.forEach(handle => {\n    monitoringQueries.push({ platform, queryText: handle, queryType: 'handle_variant' });\n  });\n});\n\nreturn {\n  json: {\n    ...item,\n    handleVariants,\n    monitoringQueries,\n    queryBatchSize: monitoringQueries.length\n  }\n};"
      },
      "typeVersion": 2
    },
    {
      "id": "d5fad1dd-d228-4068-a3c0-21c6fcc4b7ee",
      "name": "Fetch Candidate Brand Mentions & Accounts",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        1856,
        928
      ],
      "parameters": {
        "url": "https://YOUR-BRAND-MONITORING-API.example.com/v1/search",
        "method": "POST",
        "options": {},
        "jsonBody": "={\n  \"brandName\": \"{{ $json.brandName }}\",\n  \"scanId\": \"{{ $json.scanId }}\",\n  \"queries\": {{ JSON.stringify($json.monitoringQueries) }}\n}",
        "sendBody": true,
        "sendHeaders": true,
        "specifyBody": "json",
        "headerParameters": {
          "parameters": [
            {
              "name": "Authorization",
              "value": "Bearer YOUR_TOKEN_HERE"
            }
          ]
        }
      },
      "typeVersion": 4.2
    },
    {
      "id": "c9a485fe-7084-49af-b019-2168e4a92b75",
      "name": "AI - Classify & Score Impersonation Candidates",
      "type": "@n8n/n8n-nodes-langchain.agent",
      "position": [
        2304,
        928
      ],
      "parameters": {
        "text": "=You are a brand-protection analyst reviewing candidate social accounts and web mentions that may be impersonating a real brand, in order to flag fake accounts, cloned logos, and AI-voice or phishing scams.\n\nProtected Brand: {{ $json.brandName }}\nOfficial Domains: {{ $json.officialDomains }}\nOfficial Social Handles (JSON): {{ $json.officialSocialHandlesJson }}\nBrand Logo Description: {{ $json.logoDescription }}\nExecutives Commonly Impersonated: {{ $json.executiveNames }}\nKnown Scam Patterns Used Against This Brand: {{ $json.knownScamPatterns }}\n\nCandidate Accounts / Mentions Found This Scan (JSON):\n{{ JSON.stringify($json.candidateMentions) }}\n\nFor EACH candidate in the list above, decide whether it is likely impersonating this brand, and if so, what kind of threat it represents. Be conservative about false positives: fan accounts, review sites, and press mentions that clearly aren't posing as the brand itself should be marked as not impersonation.\n\nReturn a JSON array, one object per candidate, with EXACTLY these fields:\n[\n {\n  \"accountHandle\": \"matching accountHandle above\",\n  \"platform\": \"matching platform above\",\n  \"isLikelyImpersonation\": true or false,\n  \"impersonationType\": \"Fake Account|Cloned Logo or Visual Identity|AI-Voice Scam Report|Phishing Link|Counterfeit Listing|Not Impersonation\",\n  \"aiRiskScore\": <number 0-100, 100 = certain malicious impersonation>,\n  \"redFlags\": [\"flag1\", \"flag2\"],\n  \"recommendedAction\": \"Report to Platform|Send Cease and Desist|Monitor|No Action Needed\",\n  \"briefRationale\": \"One to two sentences explaining the call\"\n }\n]\n\nReturn ONLY the JSON array. No markdown, no explanation.",
        "options": {},
        "promptType": "define"
      },
      "typeVersion": 1.6
    },
    {
      "id": "98a98479-745d-4c80-9908-7d54f25060aa",
      "name": "Anthropic - Impersonation Classification Model",
      "type": "@n8n/n8n-nodes-langchain.lmChatAnthropic",
      "position": [
        2384,
        1152
      ],
      "parameters": {
        "model": {
          "__rl": true,
          "mode": "list",
          "value": "claude-sonnet-4-20250514"
        },
        "options": {
          "temperature": 0.2
        }
      },
      "credentials": {
        "anthropicApi": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 1.3
    },
    {
      "id": "5d73c8ca-73b9-42d6-9623-682a6db807c4",
      "name": "JS - Parse Impersonation Classification Output",
      "type": "n8n-nodes-base.code",
      "position": [
        2576,
        928
      ],
      "parameters": {
        "mode": "runOnceForEachItem",
        "jsCode": "const item = $input.item.json;\nlet classifications = [];\nlet classificationParsedSuccessfully = true;\ntry {\n  const rawText = item.output || item.text || item.response || '[]';\n  const clean = rawText.replace(/```json|```/g, '').trim();\n  classifications = JSON.parse(clean);\n  if (!Array.isArray(classifications)) throw new Error('not an array');\n} catch (e) {\n  classificationParsedSuccessfully = false;\n  classifications = (item.candidateMentions || []).map(c => ({\n    accountHandle: c.accountHandle,\n    platform: c.platform,\n    isLikelyImpersonation: true,\n    impersonationType: 'Unclear',\n    aiRiskScore: 50,\n    redFlags: ['AI classification parsing failed - flagged for manual review as a precaution'],\n    recommendedAction: 'Monitor',\n    briefRationale: 'Auto-flagged: could not parse AI classification output, defaulting to manual review.'\n  }));\n}\n\nreturn {\n  json: {\n    ...item,\n    classifications,\n    classificationParsedSuccessfully,\n    classifiedCount: classifications.length\n  }\n};"
      },
      "typeVersion": 2
    },
    {
      "id": "d1e3ba79-a9de-41b4-ba8b-dca92e4e1579",
      "name": "JS - Calculate Aggregate Threat Score & Format Alert Record",
      "type": "n8n-nodes-base.code",
      "position": [
        2800,
        928
      ],
      "parameters": {
        "mode": "runOnceForEachItem",
        "jsCode": "const item = $input.item.json;\nconst classifications = item.classifications || [];\nconst candidateByHandle = {};\n(item.candidateMentions || []).forEach(c => { candidateByHandle[c.accountHandle] = c; });\n\nconst now = Date.now();\n\nconst scoredThreats = classifications\n  .filter(c => c.isLikelyImpersonation)\n  .map(c => {\n    const candidate = candidateByHandle[c.accountHandle] || {};\n    const followerCount = candidate.followerCount || 0;\n    const createdDate = candidate.accountCreatedDate ? new Date(candidate.accountCreatedDate).getTime() : now;\n    const accountAgeDays = Math.max(0, Math.round((now - createdDate) / (1000 * 60 * 60 * 24)));\n    const imageSimilarity = candidate.profileImageSimilarityScore || 0;\n\n    // Reach factor: more followers means higher priority, capped so mega-accounts don't dominate\n    const reachFactor = Math.min(20, Math.round(Math.log10(followerCount + 1) * 6));\n    // New-account factor: very new accounts are riskier\n    const newAccountFactor = accountAgeDays < 30 ? 15 : accountAgeDays < 90 ? 8 : 0;\n    // Visual clone factor: how closely the logo or profile image matches the real brand\n    const visualCloneFactor = Math.round(imageSimilarity * 0.15);\n    // AI-voice scams are treated as inherently urgent regardless of reach\n    const voiceScamBoost = c.impersonationType === 'AI-Voice Scam Report' ? 20 : 0;\n\n    const compositeThreatScore = Math.max(0, Math.min(100, Math.round(\n      (c.aiRiskScore || 0) * 0.6 + reachFactor + newAccountFactor + visualCloneFactor + voiceScamBoost\n    )));\n\n    let priorityTier = 'Low';\n    if (compositeThreatScore >= 80) priorityTier = 'Critical';\n    else if (compositeThreatScore >= 60) priorityTier = 'High';\n    else if (compositeThreatScore >= 40) priorityTier = 'Medium';\n\n    return {\n      ...c,\n      followerCount,\n      accountAgeDays,\n      compositeThreatScore,\n      priorityTier\n    };\n  })\n  .sort((a, b) => b.compositeThreatScore - a.compositeThreatScore);\n\nconst scanSummaryRows = scoredThreats.map(t => [\n  item.scanId || 'N/A',\n  t.platform || '',\n  t.accountHandle || '',\n  t.impersonationType || '',\n  t.compositeThreatScore,\n  t.priorityTier,\n  t.recommendedAction || '',\n  JSON.stringify(t.redFlags || []),\n  item.scanStartedAt || ''\n]);\n\nconst escalationRequired = scoredThreats.some(t => t.priorityTier === 'Critical' || t.impersonationType === 'AI-Voice Scam Report');\nconst topThreats = scoredThreats.slice(0, 5);\n\nreturn {\n  json: {\n    ...item,\n    scoredThreats,\n    threatCount: scoredThreats.length,\n    scanSummaryRows,\n    topThreats,\n    escalationRequired\n  }\n};"
      },
      "typeVersion": 2
    },
    {
      "id": "147c22b7-4230-4081-8a33-ce779fd5a0c3",
      "name": "Save Scan Results to Google Sheets Tracker",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        3024,
        928
      ],
      "parameters": {
        "url": "https://sheets.googleapis.com/v4/spreadsheets/YOUR_SHEET_ID/values/ImpersonationScans!A1:append?valueInputOption=USER_ENTERED",
        "method": "POST",
        "options": {},
        "jsonBody": "={\n  \"values\": {{ JSON.stringify($json.scanSummaryRows) }}\n}",
        "sendBody": true,
        "specifyBody": "json",
        "authentication": "genericCredentialType",
        "genericAuthType": "oAuth2Api"
      },
      "credentials": {
        "oAuth2Api": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 4.2
    },
    {
      "id": "31117ad5-e1c6-4d61-bc55-f57606cee019",
      "name": "IF - Escalation Required",
      "type": "n8n-nodes-base.if",
      "position": [
        3248,
        928
      ],
      "parameters": {
        "options": {},
        "conditions": {
          "options": {
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "cond-escalation-required",
              "operator": {
                "type": "boolean",
                "operation": "true"
              },
              "leftValue": "={{ $json.escalationRequired }}",
              "rightValue": ""
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "555ff4f1-08b6-4184-b309-0ca5ba829aa7",
      "name": "Send Critical Impersonation Alert Email",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        3680,
        736
      ],
      "parameters": {
        "url": "https://api.sendgrid.com/v3/mail/send",
        "method": "POST",
        "options": {},
        "jsonBody": "={\n  \"personalizations\": [{\"to\": [{\"email\": \"{{ $json.alertEmail }}\"}]}],\n  \"from\": {\"email\": \"deepfake-hunter@meridiantravel.example.com\", \"name\": \"Brand Impersonation Hunter\"},\n  \"subject\": \"Critical impersonation alert: {{ $json.brandName }} ({{ $json.scanId }})\",\n  \"content\": [{\n    \"type\": \"text/plain\",\n    \"value\": \"Scan {{ $json.scanId }} for {{ $json.brandName }} found {{ $json.threatCount }} likely impersonation account(s), including at least one Critical-tier or AI-voice scam threat.\\n\\nTop threats:\\n{{ JSON.stringify($json.topThreats) }}\\n\\nAll flagged accounts have been logged to the tracker sheet. Please review and initiate takedown or cease-and-desist action as appropriate.\"\n  }]\n}",
        "sendBody": true,
        "sendHeaders": true,
        "specifyBody": "json",
        "headerParameters": {
          "parameters": [
            {
              "name": "Authorization",
              "value": "Bearer YOUR_TOKEN_HERE"
            }
          ]
        }
      },
      "typeVersion": 4.2
    },
    {
      "id": "d570fed7-1560-4908-a1f6-36f0aeb29f54",
      "name": "Wait For Alert Delivery",
      "type": "n8n-nodes-base.wait",
      "position": [
        3472,
        736
      ],
      "parameters": {},
      "typeVersion": 1
    },
    {
      "id": "e5af7317-fb20-4d1b-a301-9116c0b7356d",
      "name": "Wait For Impersonation Classification AI",
      "type": "n8n-nodes-base.wait",
      "position": [
        2080,
        928
      ],
      "parameters": {},
      "typeVersion": 1
    }
  ],
  "active": false,
  "settings": {
    "executionOrder": "v1"
  },
  "versionId": "31b5e54a-f8ad-46be-8ef2-add3472eda37",
  "connections": {
    "Wait For Alert Delivery": {
      "main": [
        [
          {
            "node": "Send Critical Impersonation Alert Email",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF - Escalation Required": {
      "main": [
        [
          {
            "node": "Wait For Alert Delivery",
            "type": "main",
            "index": 0
          }
        ],
        []
      ]
    },
    "Set - Prepare Brand Protection Context": {
      "main": [
        [
          {
            "node": "JS - Build Brand Monitoring Query Batch",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "JS - Build Brand Monitoring Query Batch": {
      "main": [
        [
          {
            "node": "Fetch Candidate Brand Mentions & Accounts",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Schedule Trigger - Continuous Brand Scan": {
      "main": [
        [
          {
            "node": "Set - Prepare Brand Protection Context",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Wait For Impersonation Classification AI": {
      "main": [
        [
          {
            "node": "AI - Classify & Score Impersonation Candidates",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fetch Candidate Brand Mentions & Accounts": {
      "main": [
        [
          {
            "node": "Wait For Impersonation Classification AI",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Save Scan Results to Google Sheets Tracker": {
      "main": [
        [
          {
            "node": "IF - Escalation Required",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "AI - Classify & Score Impersonation Candidates": {
      "main": [
        [
          {
            "node": "JS - Parse Impersonation Classification Output",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Anthropic - Impersonation Classification Model": {
      "ai_languageModel": [
        [
          {
            "node": "AI - Classify & Score Impersonation Candidates",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    },
    "JS - Parse Impersonation Classification Output": {
      "main": [
        [
          {
            "node": "JS - Calculate Aggregate Threat Score & Format Alert Record",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "JS - Calculate Aggregate Threat Score & Format Alert Record": {
      "main": [
        [
          {
            "node": "Save Scan Results to Google Sheets Tracker",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Credentials you'll need

Each integration node will prompt for credentials when you import. We strip credential IDs before publishing — you'll add your own.

• anthropicApi
• oAuth2Api

About this workflow

This workflow runs every 4 hours to search a brand-monitoring API for lookalike accounts and mentions, uses Anthropic Claude to classify impersonation risk, logs results to Google Sheets, and sends a SendGrid email alert when critical or AI-voice scam threats are detected. Runs…

Source: https://n8n.io/workflows/17360/ — original creator credit. Request a take-down →

More AI & RAG workflows → · Browse all categories →

Related workflows

Workflows that share integrations, category, or trigger type with this one. All free to copy and import.