Spike in user reported spam

You received an email explaining that a high volume of users marked emails as spam.

• Gmail

The alert is for information purposes only, and it means an unusually high volume of messages have been marked as spam by users in your organization.

For instructions on blocking the sender, see Block specific senders based on email or domain. To find similar messages that users may not have reported, to reclassify messages, and to remove these messages from user inboxes, go to the investigation tool (for instructions, see Take action based on search results).

From the Alert details page, you can view important details about this alert:

• Summary—This section includes a summary of the alert—for example, the number of spam messages and the number of recipients.
• Date—Date and time of the event (this is usually the date of the first message that's reported within the spike grouping)
• Total user reports
• Received by—Lists the number of recipients and the usernames of the recipients

The details page also includes a list of samples of user reports. This list is included in a table at the bottom of the page. Each item in the list includes the date, message ID, subject hash, message body hash, username of the recipient, attachment hashes, and your primary domain name.

An unusually high volume of messages have been marked as spam by users in your organization.