Spot the phish and report it
A phishing verdict comes from several clues together: the display name does not match the sender domain, SPF, DKIM, and DMARC fail, the URL leads to a credential form, and the message uses urgency. Inspect those indicators, review the tenant-wide scope, purge every copy, and block the sender domain so it cannot resend. This page teaches a job procedure. These are not exam questions, nothing here comes from any exam, and this is not PBQ practice.
Steps
- 1
Open the quarantined message and compare the sender address with the display name. Select Inspect phishing indicators, then check the Authentication tab for failed SPF, DKIM, and DMARC, the URLs tab for the credential-collection link, the urgent account-closure language, and the Attachments tab for the absence of a file.
- 2
Review the tenant scope and confirm that 47 recipients received the message.
- 3
Use Search and purge tenant-wide to remove the matching campaign while retaining the quarantine evidence.
- 4
Block asterrow-support.example at the mail gateway so the campaign cannot resend.
What you should see
The console confirms 47 recipients, reports the message purged tenant-wide, and shows asterrow-support.example blocked at the mail gateway.