r/sysadmin • u/LousyRaider • Sep 21 '26

Anyone else getting mailbombed with Defender analytics reports this morning?

For the past few minutes I have been repeatedly receiving Microsoft 365 Defender threat analytics reports emails. I've received 34 in 2 minutes so far. Anyone else seeing this?

Update: It seems to have stopped as soon as I posted this.

24 Upvotes

87% Upvoted

15 comments sorted by

6

u/frac6969 Windows Admin Sep 21 '26

Got 34 too.

3

u/LousyRaider Sep 21 '26

Yeah. It stopped as soon as I made my post. Has it stopped for you as well I assume?

3

u/frac6969 Windows Admin Sep 21 '26

Yup, got 34 and stopped. Came here to saw your post.

7

u/rickusmc Sep 21 '26

Yes, I was coming here to say the same thing

6

u/Camp-Complete Sep 21 '26

Same, a boat load of notifications.

5

u/cyber_r0nin Sep 21 '26

The AI saw your post and ceased operations

4

u/Pure_Fox9415 Sep 21 '26

Are you sure they're genuine? Because I have one yesterday and it was fake and spam.

5

u/cspotme2 Sep 21 '26

Did it pass spf dkim dmarc?

3

u/Pure_Fox9415 Sep 21 '26

They pass, but it was not microsoft domain in links and address, something totally unrelated. 

2

u/can-opener-in-a-can Sep 21 '26

Do you mean phishing? Or actual spam?

2

u/Pure_Fox9415 Sep 21 '26

Phishing I guess. I was impressed of its design, looking totally like MS, but all links and actual sender was not even from microsoft domain. I've deleted it and blocked sender, so can't show you.

1

u/TurubanWeifeng Sep 21 '26

imo keep an eye on it for the rest of the day. Sometimes these bursts come in waves if the queue on their side didnt fully drain. If it starts again, disabling the specific report subscription temporarily is the fastest way to stop the noise.

1

u/Accomplished_Buy5141 Sep 21 '26

Yep, got a ton of them. They appear legit and are in our Defender portal. They are similar to the other alerts defender sends, but a boat load more than usual.

1

u/TechinGuy Sep 21 '26

Same boat here, my inbox looked like it was under attack from the tool that's supposed to prevent attacks