SpaGreen Creative This workflow corresponds to n8n.io template #13581 — we link there as the canonical source.
This workflow follows the Gmail Trigger → Google Sheets recipe pattern — see all workflows that pair these two integrations.
The workflow JSON
Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →
{
"id": "GMdS6V4ABW0CZ5M1",
"meta": {
"templateCredsSetupCompleted": true
},
"name": "Automatically Detect Suspicious Links in Gmail Messages",
"tags": [],
"nodes": [
{
"id": "9c1dec44-85f2-4db3-8719-10effcdd1209",
"name": "Gmail Trigger",
"type": "n8n-nodes-base.gmailTrigger",
"position": [
448,
880
],
"parameters": {},
"typeVersion": 1.3
},
{
"id": "50422eb2-703a-445b-9d3f-715fbf0cbcf0",
"name": "Loop Over Items",
"type": "n8n-nodes-base.splitInBatches",
"position": [
1024,
880
],
"parameters": {},
"typeVersion": 3
},
{
"id": "35da8deb-a840-434e-a5cd-3a5a8524c203",
"name": "Sticky Note1",
"type": "n8n-nodes-base.stickyNote",
"position": [
432,
832
],
"parameters": {
"content": ""
},
"typeVersion": 1
},
{
"id": "c3aa2dbc-2592-41fc-9b59-4c4f199e6c68",
"name": "Sticky Note2",
"type": "n8n-nodes-base.stickyNote",
"position": [
0,
832
],
"parameters": {
"content": ""
},
"typeVersion": 1
},
{
"id": "4f6de6c2-7e2e-433e-879f-66ef90b0986d",
"name": "Sticky Note4",
"type": "n8n-nodes-base.stickyNote",
"position": [
2304,
656
],
"parameters": {
"content": ""
},
"typeVersion": 1
},
{
"id": "9fd39e40-a985-4aca-b599-5e6da03b0d6b",
"name": "Code (Converts the array of links into individual)",
"type": "n8n-nodes-base.code",
"position": [
832,
880
],
"parameters": {},
"typeVersion": 2
},
{
"id": "9e834d8b-02d8-48e5-a93a-a4a34941f952",
"name": "If (Checks if URLs contain \"google.com\" using regex)",
"type": "n8n-nodes-base.if",
"position": [
1232,
896
],
"parameters": {},
"typeVersion": 2.3
},
{
"id": "ed65d48f-25d8-4868-bcc9-fbdc8b2a1234",
"name": "If (Checks if URLs are not empty)",
"type": "n8n-nodes-base.if",
"position": [
1472,
912
],
"parameters": {},
"typeVersion": 2.3
},
{
"id": "dbea074a-5b16-4ef5-a1c1-81a330a86f6d",
"name": "VirusTotal (Submits URLs for analysis)",
"type": "n8n-nodes-base.httpRequest",
"position": [
1696,
896
],
"parameters": {},
"typeVersion": 4.3,
"extendsCredential": "virusTotalApi"
},
{
"id": "18d859fe-cc73-4307-a1e8-bb88ccfededc",
"name": "Code (VirusTotal report to extract relevant information)",
"type": "n8n-nodes-base.code",
"position": [
2096,
896
],
"parameters": {},
"typeVersion": 2
},
{
"id": "e99b3d1c-aa44-430d-86c1-2630e0c92765",
"name": "Rapiwa (WhatsApp notification)",
"type": "n8n-nodes-rapiwa.rapiwa",
"position": [
2384,
896
],
"parameters": {},
"typeVersion": 1
},
{
"id": "65e43993-d46e-4c05-b62c-8a6dca7f2664",
"name": "Logs the analysis results to a Google Sheet",
"type": "n8n-nodes-base.googleSheets",
"position": [
2384,
720
],
"parameters": {},
"typeVersion": 4.7
},
{
"id": "34673c4a-1cd0-4838-a5cd-6b2a2eb473b1",
"name": "Sends a Microsoft Teams notification",
"type": "n8n-nodes-base.microsoftTeams",
"position": [
2384,
1072
],
"parameters": {},
"typeVersion": 2
},
{
"id": "3e58d2c9-55b9-4821-9075-8a174a07eb0c",
"name": "Sticky Note3",
"type": "n8n-nodes-base.stickyNote",
"position": [
1632,
832
],
"parameters": {
"content": ""
},
"typeVersion": 1
},
{
"id": "3d5a4cf1-24fe-421c-9456-812a71a98b9d",
"name": "Code (Extracts URLs from email content)",
"type": "n8n-nodes-base.code",
"position": [
624,
880
],
"parameters": {},
"typeVersion": 2
},
{
"id": "27bdbc4d-6130-4032-a1b6-202933de0af3",
"name": "Analysis report from VirusTotal",
"type": "n8n-nodes-base.httpRequest",
"position": [
1904,
896
],
"parameters": {},
"typeVersion": 4.1
}
],
"active": false,
"settings": {
"availableInMCP": false,
"executionOrder": "v1"
},
"versionId": "2b2adc89-ed10-4b87-9bcd-9e24579461ad",
"connections": {
"Gmail Trigger": {
"main": [
[
{
"node": "Code (Extracts URLs from email content)",
"type": "main",
"index": 0
}
]
]
},
"Loop Over Items": {
"main": [
[],
[
{
"node": "If (Checks if URLs contain \"google.com\" using regex)",
"type": "main",
"index": 0
}
]
]
},
"Analysis report from VirusTotal": {
"main": [
[
{
"node": "Code (VirusTotal report to extract relevant information)",
"type": "main",
"index": 0
}
]
]
},
"If (Checks if URLs are not empty)": {
"main": [
[
{
"node": "VirusTotal (Submits URLs for analysis)",
"type": "main",
"index": 0
}
],
[
{
"node": "Loop Over Items",
"type": "main",
"index": 0
}
]
]
},
"VirusTotal (Submits URLs for analysis)": {
"main": [
[
{
"node": "Analysis report from VirusTotal",
"type": "main",
"index": 0
}
]
]
},
"Code (Extracts URLs from email content)": {
"main": [
[
{
"node": "Code (Converts the array of links into individual)",
"type": "main",
"index": 0
}
]
]
},
"Code (Converts the array of links into individual)": {
"main": [
[
{
"node": "Loop Over Items",
"type": "main",
"index": 0
}
]
]
},
"If (Checks if URLs contain \"google.com\" using regex)": {
"main": [
[
{
"node": "Loop Over Items",
"type": "main",
"index": 0
}
],
[
{
"node": "If (Checks if URLs are not empty)",
"type": "main",
"index": 0
}
]
]
},
"Code (VirusTotal report to extract relevant information)": {
"main": [
[
{
"node": "Rapiwa (WhatsApp notification)",
"type": "main",
"index": 0
},
{
"node": "Logs the analysis results to a Google Sheet",
"type": "main",
"index": 0
},
{
"node": "Sends a Microsoft Teams notification",
"type": "main",
"index": 0
}
]
]
}
}
}
For the full experience including quality scoring and batch install features for each workflow upgrade to Pro
About this workflow
This n8n workflow is designed for IT security professionals, email administrators, and organizations that want to automatically scan URLs received in emails for potential security threats. It provides a complete end-to-end system capable of automatically detecting malicious URLs…
Source: https://n8n.io/workflows/13581/ — original creator credit. Request a take-down →
Related workflows
Workflows that share integrations, category, or trigger type with this one. All free to copy and import.
📘 Description
This workflow automatically detects duplicate invoices from Gmail. Incoming PDF attachments are scanned by the easybits AI Extractor, then checked against the Master Finance File in Google Sheets. Dup
Gmail分類PoC ワークフロー. Uses gmailTrigger, httpRequest, line, googleSheets. Event-driven trigger; 8 nodes.
Receive any business document via email. The attachment is automatically classified (Invoice, Contract, or Purchase Order) using easybits Extractor, then routed down the correct path where a second Ex
The goal is to reduce inbox noise and automatically organize repetitive types of emails so that imprtant messages remain visible while unsolicited or promotional emails are handled automatically. When