google workspace alerts spam

Messages may be classified as suspicious if they meet certain characteristics typical of spam messages, but when Google does not have a strong enough signal to mark them as spam. This alert is generated when a user marks such messages as spam, thus confirming Google's suspicions.

Google Support

support.google.com › a › thread › 114669699 › message-from-google-workspace-alerts

Message from "Google Workspace Alerts" - Google Workspace Admin Community

Skip to main content · Google Workspace Admin Help · Sign in · Google Help · Help Center · Community · Google Workspace Admin · Terms of Service · Submit feedback · Send feedback on

Videos

02:39

YouTube

How to Turn Desktop Email Notifications on and Off in Google ...

How to View Alerts in Google Workspace (Full 2025 Guide) - YouTube

February 20, 2025

02:23

YouTube

How to Enable Google Alert for Everyone in Google Workspace (Full ...

February 20, 2025

05:28

YouTube

Automated Email Notifications in Google Workspace Using Google ...

November 13, 2023

youtube.com

Google Workspace Administrator - Working with the Alert Center ...

June 2, 2023

View all

Google Workspace

workspace.google.com › products › admin › alert-center

Cyber Security Alerts and Tools - Google Workspace

Get a comprehensive view of critical ... and applications. Act in real-time when suspicious activity is detected within your organization, including phishing, malware, spam, and suspicious account activity....

Google

developers.google.com › google workspace › admin console › google workspace alert types

Google Workspace Alert types | Admin console | Google for Developers

Listed in the table below are the possible values for the source field, corresponding alert type names for type field and data types for the data field · Learn more about these alert types from our support documentation

reddit.com › r/cryptocurrency › be careful of the google workplace alerts phishing scam

r/CryptoCurrency on Reddit: Be careful of the Google Workplace Alerts phishing scam

December 17, 2024 -

-------------------------Email Received------------------

From: Google Workspace Alerts : google-workspace-alerts-noreply@ google.com

reply-to: Google Workspace Alerts : google-workspace-alerts-noreply@ google.com

to: me@ death-requests.org : mailto: me@ death-requests.org

Rule Name: [ACTION REQUIRED] Legal notice regarding your Google Account - Assigned to Avery C : postmortem-legal @ google.com - Case ID: ############# ##-

This message is to notify you because this mailbox is linked to the Google Account specified in your request. We wish to express our deepest condolences during this challenging time and thank you for your patience. Should you have any concerns or additional information to share, you can access your case using the authorized email address below. To protect your privacy, sensitive information has been redacted and this message will be permanently redacted after 30 days. If you did not request this, please cancel the case at your convenience.

Case file: https://sites . google.com/u/########/d/########/edit

Full name of the deceased person: [redacted] [redacted]

Email address of the deceased person: *******@*****.***

Full name of relative/legal representative: [redacted] [redacted]

Email address of relative/legal representative: *******@*****.***

Attachments: social_scan.pdf, proof_of_address.pdf, court_certified_letters_testamentary.pdf, passport_scan.pdf, death_cert_(2).pdf

Additional comments or instructions: Please forward all replies to my protonmail, thanks.

The Google Workspace Team

1600 Amphitheatre Parkway Mountain View, CA 94043; +# (###) ###-#### (Intl.)

---------------- End of Email-----------

This is a phishing scam that will link you to a users' created login page of google. It'll steal your credentials.

The email that sends it to you uses a google.com domain. Always be careful and stay safe!

Top answer

1 of 3

1

Hello kyuronite. It looks like you might have found a new scam? If so, please report this scam by crossposting to r/CryptoScams , r/CryptoScamReport , or visiting scam-alert.io . For tips on how to avoid scams, click here . I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

2 of 3

1

I've also received this email a few times in ever increasingly clever formats. The most recent version passes all validity checks and looks like it actually comes from Google.

reddit.com › r/sysadmin › google workspace: am i supposed to do something about user reported spam in their emails?

r/sysadmin on Reddit: Google Workspace: Am I supposed to do something about user reported SPAM in their emails?

February 24, 2023 -

The message from Google I'm referencing is this;

This Spike in user-reported spam alert is to inform you that an unusually high volume of messages from a sender have been marked as spam.
The alert details include:
Summary: 12 message(s) were reported as spam by users in your domain. There was 1 recipient(s). Activity date: Wednesday, 29 Mar 2023, 09:30:43 (UTC) Total user reports: 12 Reported by: (user's email 12 times) Severity: HIGH

I've been largely ignoring these but I can't help but feel that I'm supposed to be doing something to prevent it? I don't really see anything in the Google Admin reporting tool to action this other than acknowledging and clearing the warning.

Top answer

1 of 2

5

I generally get these related to a single user when they finally start going through their inbox and reporting emails from months ago. Otherwise you can review your settings and see if it's time to step up the aggressiveness. Could just be a passing phase / spam campaign and your domain is on the list.

2 of 2

3

Getting an alert for those bulk spammers, or another way to detect the latest phishing campaign targeting users who reach for the convenient Spam button instead of digging into menus to report phishing, is great! Too bad that's not what this alert actually does, in spite of the description. This alert is basically useless. It just tells you when someone is going through a backlog of old messages reporting the junk - who the hell cares? I've turned this one off until such time as Google deigns to fix it to match the description.

Google Support

support.google.com › a › answer › 11123535

Restore message—Restore wrongly classified emails (marked as spam or quarantined) to their folder of origin. Appeal suspension—Appeal an account suspension specified in the Account suspension warning alert. Suspend user—Suspend users specified in the alert. Restore user—Restore users specified in the alert. Block device—Block the device that triggered the alert. This blocks access to Google Workspace data on the device until you can confirm the device is safe.

Clean Email

clean.email › blog › email-settings › google-workspace-emails-going-to-spam

Why Are My Google Workspace Emails Going to Spam?

July 14, 2025 - 💡 Tip: For help with some settings, such as obtaining addresses to block senders, you can view Google Workspace alerts for spam using the Alerts button (bell) or by going to Safety → Alert center to review spam alert details.

Devoteam

devoteam.com › home › expert view › how to handle phishing with google workspace

How to handle Phishing with Google Workspace | Devoteam

April 10, 2025 - Admin Console. The Alert Center is a dashboard in Google Workspace where you can find all the alerts reported in your admin center. (e.g. Suspicious login attempts, Spam or Phishing reported by the user, …)...

Find elsewhere

Google Bing Mojeek

Stanford University IT

uit.stanford.edu › news › phishing-alert-attackers-use-google-workspace-apps-steal-credentials

Phishing Alert: Attackers Use Google Workspace Apps to Steal Credentials | University IT

Attackers are exploiting a flaw in Google Workspace to send emails that include authentic google.com sender information.

reddit.com › r/gsuite › admins, how do you manage all your google workspace alerts?

r/gsuite on Reddit: Admins, how do you manage all your Google Workspace alerts?

November 4, 2025 -

I recently started looking into the admin alerts and it's a lot to manage. How do you handle things like increases in user reported spam? Do you investigate all the emails and add them to your block lists? How do you handle user reported phishing attempts?

Top answer

1 of 2

2

You can investigate them all manually — most probably end up with burnout. try some automation solutions. so what we do is we use an automated workflow built in Zenphi, since we're G-Suite heavy to handle user reports. The flow is simple: when the use reports spam/phishing, the flow pulls sender/URL/IP from the reported email. then we apply built-in Gemini model to check the report against threat feeds/block lists. Next step - auto-blocking the source + appending the list with a new source if needed. The whole point is that only unmatched threats get routed to a security ticket for human review. Basically, it handles 90% of the volume instantly

2 of 2

1

I use email filters to ensure that I see important alerts (Category: Primary, add a label in red) and don't see unimportant ones (a lot of DLP rules go to Updates). I've also adjusted my rules to better prioritize. Phishing reports I almost always investigate, spam spikes maybe. When I get an alert that I want to address, I open the alert center so I can use it for ticket notes and status, that way our team doesn't duplicate labor. Then I usually search in vault/ediscovery, using a broad search. If one user reported phishing, I want to find out if the email has gone to other users. From there I'll do a few things: Block the address or whole domain. Might also look for how to block the pattern with compliance rules. If the domain itself is legit, notify the IT department there about a compromised account. Export accounts with matches and notify the users about the phishing (and ask if they fell for it). Might even use GAM to delete the emails (gam csv gam user ~Email delete messages query "from: [email protected] "). There's not many worse feelings as an admin than when you are aware of phishing or some other scam, assume your users won't fall for it, and then one of them does.

Folderly

help.folderly.com › en › articles › 9331210-types-of-google-workspace-alerts

Types of Google Workspace Alerts | Go to Folderly

When recipients of cold outreach emails frequently mark these messages as spam, Google may raise alarms. If enough people move your emails to their "Spam" folder, Google might flag your content as suspicious and issue a warning.

reddit.com › r/scams › a scam which uses google workspace alerts

r/Scams on Reddit: A scam which uses Google Workspace Alerts

December 3, 2024 -

Hi,

I received this email from: Google Workspace Alerts <google-workspace-alerts-noreply at google.com>, (I changed the "@" symbol to "at" to adhere to the rules) looks like a legit address.

The link at the bottom of the email actually links to Google's alert center. I'm a "vanilla" google user (not a workspace user), and therefore, I have no way of logging in. Is this a scam? Has this attack been documented anywhere? What's the recommended course of action?

The email "header" is the following. Note that the "to" address isn't my email:

|| || |from:|Google Workspace Alerts google-workspace-alerts-noreply at google.com| |reply-to:|Google Workspace Alerts google-workspace-alerts-noreply at google.com | |to:|me at cases-postmortem.org | |date:|Mar 4, 2025, 8:10 AM| |subject:|Alert: Reporting rule - [ACTION REQUIRED] New reply in legal matter regarding your Google Account| |mailed-by:|eforward.registrar-servers.com| |signed-by:|google.com| |security:| Standard encryption (TLS) Learn more| |:|Important according to Google magic.|

Here's the full text of the email:

Google Workspace Image

This Reporting rule alert is to inform you that specific activity occurred based on a custom reporting rule.

The alert details include:

Date: Wed, Mar 19 2025 00:47 UTC

Rule Name: [Action Required] We are required to submit a response in the legal matter regarding your Google Account - Assigned to Daniel C ([email protected]) Case ID: 795429234687134065327576321 ... (Removed by OP) Case file: Case file: https://sites dot google dot com/u/0096... (changed . to dot and full link removed by OP, to avoid a chance of someone accidently opening it and getting baited) //... (Removed by OP) Attachments: social_scan.pdf, proof_of_address.pdf, court_certified_letters_testamentary.pdf, passport_scan.pdf, death_cert_(2).pdf Additional comments or instructions: Please forward all replies to my protonmail, thanks. The Google Workspace Team

Top answer

1 of 4

2

We have seen this postmortem scam here before within last week or two

2 of 4

1

u/zvuvy - Your post has been queued for moderation because it looks like you included a clickable link. Reddit Admins will remove posts to dangerous websites, so we have to look out for one another. The safe way to post about scam websites is: Write the website address in the title of your post Don't post clickable links in the body text So: If your post already has a website address in the title: edit the body of your post to remove the clickable link. For example, you can replace a .com with (dot)com - then wait until a moderator comes to take a look and approve this. If you didn't put the website address in the title: since titles aren't editable, we encourage you to delete this post, and post again - this time, writing the website in the title of your new post. If this post is NOT about a possible scam website: for example, if you tried to share a news article, or a government website, etc - just wait until a moderator comes to take a look and approve this. Questions about subreddit rules? Send us a modmail clicking here . I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

Google

developers.google.com › google workspace › admin console › mailphishing

MailPhishing | Admin console | Google for Developers

Google Workspace · Admin console · Reference · Send feedback · JSON representation · Proto for all phishing alerts with common payload. Supported types are any of the following: User reported phishing · User reported spam spike · Suspicious message reported ·

Hand-delivered

hand-delivered.email › googles-alert-spike-in-user-reported-spam

Google’s Alert: Spike in user-reported spam - Email Deliverability and Automation Expert

April 24, 2022 - It’s a notification sent to you as an admin that one or more of your Google Workspace users reported they’re receiving a high volume of spam messages. Example of the alert “Spike in user-reported spam”

Hacker News

news.ycombinator.com › item

The thing that makes this fishy is that I also received an email for my Google W... | Hacker News

June 28, 2021 - https://support.google.com/a/answer/10685032?hl=en · Could something have happened across their entire Zanzibar/ ACL infrastructure

Google Workspace

workspaceupdates.googleblog.com › 2018 › 12 › better-information-on-spam-messages-in.html

Google Workspace Updates: Better information on spam messages in Email Log Search

This official feed from the Google Workspace team provides essential information about new features and improvements for Google Workspace customers. ... As a G Suite admin, you can now get more detailed and helpful information in the Admin console about emails that have been marked as spam.

Deepit

deepit.com › home › google workspace › dealing with spam in google workspace

How to Manage Spam in Google Workspace

April 2, 2025 - This helps train Google’s algorithm and improves spam detection across all users. 🔄 The more consistently you report spam, the better Gmail becomes at filtering similar messages in the future. Legitimate newsletters or promotional emails typically have an Unsubscribe link at the top. ✅ Use it for known senders like online stores or services. ❌ Avoid clicking unsubscribe in emails from unknown or suspicious sources — this could alert ...

Google Support

support.google.com › a › answer › 3230421

View and edit system-defined rules - Google Workspace Admin Help

Spike in user-reported spam—An unusually high volume of messages from a sender that users have marked as spam. TLS failure—Messages requiring Transport Layer Security (TLS) can't be delivered. Alerts for setting changes by other administrators · Calendar settings changed (Google Workspace only)—An admin has changed Google Workspace Calendar settings.

Tines

tines.com › blog › centralize-triage-and-respond-to-alerts-from-the-google-workspace-g-suite-alert-c

Centralize, triage and, respond to alerts from the Google Workspace (G Suite) Alert Centre | Tines

April 23, 2021 - Out of the box, G Suite Alert Center includes the following types of alerts: Device compromised · Suspicious device activity · User-reported phishing · Attacks caused by bad whitelists · Google Operations · Spike in user reported spam · Suspicious message reported ·