Incoming SPAM Email from Gmail

%3CLINGO-SUB%20id%3D%22lingo-sub-1396573%22%20slang%3D%22en-US%22%3EIncoming%20SPAM%20Email%20from%20Gmail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1396573%22%20slang%3D%22en-US%22%3E%3CP%3EThere%20has%20been%20instances%20where%20many%20employee%20get%20emails%20from%20a%20particular%20gmail%20if%20within%20short%20span%20of%20time.%20How%20do%20we%20block%20this%20as%20blocking%20that%20particular%20email%20will%20not%20help%20as%20the%20person%20will%20change%20the%20email%20id%20and%20send%20again.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1396573%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1396737%22%20slang%3D%22en-US%22%3ERe%3A%20Incoming%20SPAM%20Email%20from%20Gmail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1396737%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F670326%22%20target%3D%22_blank%22%3E%40hemen1645%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20is%20a%20tricky%20one%20as%20you%20cannot%20block%20gmail.com%20(well%20you%20can%2C%20but%20that%20is%20not%20a%20practical%20solution).%20%26nbsp%3BAre%20there%20any%20other%20common%20factors%20in%20the%20emails%20that%20you%20are%20receiving%20(such%20as%20the%20subject%20for%20example)%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1396772%22%20slang%3D%22en-US%22%3ERe%3A%20Incoming%20SPAM%20Email%20from%20Gmail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1396772%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F616707%22%20target%3D%22_blank%22%3E%40PeterRising%3C%2FA%3Eyou%20have%20no%20control%20on%20the%20subject%20line%20or%20content%20of%20the%20body%2C%20the%20person%20can%20randomize%20the%20subject%20and%20body%20content.%26nbsp%3B%20%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1396802%22%20slang%3D%22en-US%22%3ERe%3A%20Incoming%20SPAM%20Email%20from%20Gmail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1396802%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F670326%22%20target%3D%22_blank%22%3E%40hemen1645%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWell%20that%20is%20certainly%20true.%20%26nbsp%3BI%20just%20wondered%20if%20in%20this%20particular%20instance%2C%20you%20had%20seen%20any%20commonalities.%20%26nbsp%3BUnlikely%20I%20agree%2C%20%26nbsp%3Bbut%20you%20never%20know.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1396823%22%20slang%3D%22en-US%22%3ERe%3A%20Incoming%20SPAM%20Email%20from%20Gmail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1396823%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F670326%22%20target%3D%22_blank%22%3E%40hemen1645%3C%2FA%3E%26nbsp%3BHello%2C%20I%20assume%20that%20your%20spam%20filter%20policy%20is%20adjusted%20in%20a%20way%20that%20suit%20your%20needs%3F%20We've%20changed%20a%20few%20default%20settings%20and%20are%20using%20the%20more%20strict%20recommendations%20from%20Microsoft%20(most%20of%20it%20ends%20up%20in%20quarantine).%20Still%20there%20is%20no%20way%20to%20be%20100%20%25%20as%20our%20users%20do%20get%20spam%20and%20phishing%20sometimes.%20Anyway%2C%20as%20a%20consequence%20we%20enabled%20the%20tool%20%22Report%20Message%22%20about%20a%20year%20ago%20to%20the%20entire%20organization%20and%20now%20our%20end-users%20are%20managing%20the%20occasional%20spam%2Fphishing%20from%20within%20their%20own%20clients.%20It's%20a%20great%20tool%20for%20reporting%20messages%20to%20Microsoft%20and%20user%20friendly%20as%20well.%20Perhaps%20not%20applicable%20for%20your%20org%2Fscenario%20but%20I%20just%20wanted%20to%20share%20my%20experience.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1396838%22%20slang%3D%22en-US%22%3ERe%3A%20Incoming%20SPAM%20Email%20from%20Gmail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1396838%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F551905%22%20target%3D%22_blank%22%3E%40bec064%3C%2FA%3E%26nbsp%3B-%26nbsp%3BThis%20is%20a%20great%20shout.%20%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1396910%22%20slang%3D%22en-US%22%3ERe%3A%20Incoming%20SPAM%20Email%20from%20Gmail%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1396910%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F670326%22%20target%3D%22_blank%22%3E%40hemen1645%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESince%20this%20is%20Gmail%20user%2C%20you%20may%20file%20a%20abuse%20report%20directly%20to%20Google%20%2C%20so%20they%20could%20investigate%20the%20account%20and%20they%20will%20find%20with%20similar%20behavior%2C%20pattern%2C%20IP%20and%20other%20methods%20to%20block%20user%3A%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.google.com%2Fmail%2Fcontact%2Fabuse%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.google.com%2Fmail%2Fcontact%2Fabuse%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EMeanwhile%2C%20ask%20your%20users%20to%20mark%20this%20as%20Junk%2C%20so%20Anti-Spam%20algorithm%20in%20Microsoft%20Outlook%20could%20identify%20spam%20pattern%20and%20learn%20to%20block%20it.%3C%2FP%3E%0A%3CP%3EYou%20may%20use%20admin%20submission%20in%20Microsoft%20365%20portal%20and%20submit%20some%20sample%20of%20it%3A%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Foffice-365-security%2Fadmin-submission%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Foffice-365-security%2Fadmin-submission%3Fview%3Do365-worldwide%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20will%20find%20some%20useful%20resources%20here%3A%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Foffice-365-security%2Fanti-spam-protection%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Foffice-365-security%2Fanti-spam-protection%3Fview%3Do365-worldwide%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

There has been instances where many employee get emails from a particular gmail if within short span of time. How do we block this as blocking that particular email will not help as the person will change the email id and send again. 

6 Replies

@hemen1645 

 

This is a tricky one as you cannot block gmail.com (well you can, but that is not a practical solution).  Are there any other common factors in the emails that you are receiving (such as the subject for example)?

@PeterRisingyou have no control on the subject line or content of the body, the person can randomize the subject and body content.   

@hemen1645 

 

Well that is certainly true.  I just wondered if in this particular instance, you had seen any commonalities.  Unlikely I agree,  but you never know.

@hemen1645 Hello, I assume that your spam filter policy is adjusted in a way that suit your needs? We've changed a few default settings and are using the more strict recommendations from Microsoft (most of it ends up in quarantine). Still there is no way to be 100 % as our users do get spam and phishing sometimes. Anyway, as a consequence we enabled the tool "Report Message" about a year ago to the entire organization and now our end-users are managing the occasional spam/phishing from within their own clients. It's a great tool for reporting messages to Microsoft and user friendly as well. Perhaps not applicable for your org/scenario but I just wanted to share my experience.

@ChristianBergstrom - This is a great shout.  

@hemen1645 

 

Since this is Gmail user, you may file a abuse report directly to Google , so they could investigate the account and they will find with similar behavior, pattern, IP and other methods to block user:

https://support.google.com/mail/contact/abuse 

Meanwhile, ask your users to mark this as Junk, so Anti-Spam algorithm in Microsoft Outlook could identify spam pattern and learn to block it.

You may use admin submission in Microsoft 365 portal and submit some sample of it:

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/admin-submission?view=o3... 

You will find some useful resources here:

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spam-protection?vie...