Report malicious and phishing emails, block senders, view quarantine
Overview
This article describes ways to deal with phishing or otherwise malicious emails by reporting it and by utilizing the Microsoft tools available with your email account.
Do not hesitate to open a service desk ticket if you are unsure.
Do Not Click on Links in Suspicious Emails
Whenever you suspect that an email might have been sent maliciously, do not click on any links in the email, reply to the email, or download any attachments from the email.
LIBRARY STAFF |
|
IT Services KB: Microsoft documentation: |
Report Abuse/Phishing to UCLA
If you receive a suspected (or blatant) malicious email please report it to UCLA IT Services by forwarding a copy to security@ucla.edu. If it appears to be targeting Library staff specifically, please also create a ticket for DIIT.
In Outlook, the best way is to create a new message to security@ucla.edu, then drag the malicious email onto it to attach it as a .eml file.
This is described in more detail on the IT Services page - Instructions for Reporting a Phishing Scam.
Report to Google
Sometimes cleverly-named Gmail accounts are used to directly target Library staff, appearing to come from someone in a leadership position.
A past example was an account called vsteel.library.ucla.edu@gmail.com
There is very little that DIIT or IT Services can do about these "throwaway" accounts, so you are encouraged to report them to Google using this form: support.google.com/mail/contact/abuse
Casualties of the Google Play Gift Card scam can report it to Google via this form: gc_scam_report
If you actually purchased a gift card, we recommend filling this out.
Allow or Block Senders
The lists and settings for allowing or blocking senders is found in the junk email settings in Outlook online.
Prior to June 2022, a system called Barracuda was used to quarantine emails and manage the allow/block list.
It has been retired and is no longer available.
Sign in to outlook.office.com using a browser, then click on the gear icon in the upper right and select "View all Outlook settings"
Select Mail > Junk email, to view Blocked senders and domains, Safe senders and domains, and other settings.
View Quarantined Messages
Messages that are suspected to be malicious or spam might be quarantined and will not appear in your inbox without your intervention.
To view your email quarantine, visit security.microsoft.com/quarantine and sign in with your UCLA Logon ID (or @ad.ucla.edu for shared accounts).
Senders can also be blocked from the quarantine page.
The email quarantine is part of Microsoft 365 Defender. You may see the acronym EOP, which refers to "Microsoft 365 Exchange Online Protection".
Microsoft provides documentation of how to find and release quarantined messages as a user in EOP
Allowing Senders
If you wish to release a quarantined message and then allow that email address to not be quarantined again:
Release the quarantined message from https://security.microsoft.com/quarantine
In OWA (Outlook Web Access):
Right-click on the released email
Choose Block → Never block sender
Quarantine Email Notifications
After one or more incoming emails are quarantined, staff will get a notification from quarantine@messaging.microsoft.com about the message.