Shared mailboxes are the nerve center for customer support and operations — but they’re also a prime target for phishing. Every day, support@, info@ and other shared accounts receive dozens or hundreds of messages. Without automated scanning, dangerous messages slip through, staff waste time, and organization risk increases. MailShield AI is a practical, no-code approach that combines Outlook triggers, VirusTotal URL scans, and Grok AI classification to detect, log, and triage phishing email automatically.
At a glance, the workflow does three things: (1) fetch email from a shared Outlook inbox; (2) inspect links and content using a mix of signature-based and AI analysis; and (3) act — log, forward to security, or move messages out of the inbox. This hybrid approach balances the accuracy of reputation engines with the pattern recognition of modern LLM-style models.
The flow starts with an Outlook Trigger node. It watches the shared mailbox on a short interval (e.g., every 5 minutes) and hands each new message into the pipeline. The Extract node then pulls useful fields — sender, subject, full body text, attachments, and any URLs matched by a safe URL regex. Extracting headers and attachments here is important because attackers hide payloads in obscure headers or use attachments with macros.
Links go to VirusTotal first. VirusTotal is a signature and reputation service: it checks if a URL, domain, or file is known to be malicious. Submitting the URL returns an analysis id you can later poll to get verdict details. This step is low-risk and high-value — it flags previously seen malicious infrastructure and is excellent for blocking known threats.
Parallel to reputation checks, the anonymized email body goes to an AI classifier (Grok). Before sending, the workflow redacts email addresses, phone numbers, and long tokens so private data is not exposed to a third party. The AI is instructed to respond with a single verdict: Safe, Suspicious, or Phishing. Using a short deterministic prompt and low temperature reduces hallucination and keeps outputs predictable.
A Switch (decision) node reads the AI verdict and routes the message: Safe messages are logged only; Suspicious messages are forwarded to IT for human review; confirmed Phishing messages are moved to a dedicated “Phishing” folder. Every action is logged into Google Sheets with timestamp, sender, subject, classification, VirusTotal links, and notes. This creates a searchable incident timeline and a dataset for future tuning.
A few operational best practices make this reliable in production. First, process all URLs (use SplitInBatches) rather than only the first link — attackers sometimes bury harmful links among benign ones. Second, add retry and backoff for API calls and respect rate limits for both VirusTotal and the AI provider. Third, store minimal data: keep only metadata unless a client explicitly opts in to retain full messages. Fourth, require tenant OAuth credentials — never ship a product pre-connected to third-party accounts.
Finally, think about governance. Include an Acceptable Use Policy in your product and require identity verification for paid accounts to prevent abuse. Offer a privacy mode that prevents raw-body storage and provide a customer-controlled option to disable third-party AI analysis if legal constraints require it.
MailShield AI is not a silver bullet: AI can err, and reputation services lag against zero-day infrastructure. But combined, they reduce manual triage workload dramatically, raise detection rates, and give small security teams the automation they need to respond faster. For MSPs and SMEs, deploying this no-code pipeline in n8n is an economical way to bring enterprise-grade email triage to any shared mailbox.