FAQ: Reporting spam, phishing, malware and false positive detections to LevelBlue

This article applies to:

How do I report missed detection of spam, phishing, or malware and false positives to LevelBlue?
How do I report threat URLs to LevelBlue?
How do I report false positive detections of spam, phishing, malware or other threats to LevelBlue?

There are a number of ways to report missed detections and false positives in MailMarshal Cloud:

False positives are valid messages that were quarantined as spam or malicious. The methods below can be used for any false positive detection.

(Preferred) In Customer Console > Mail History, search for the email in question. Use the "Not Spam" button above the history list or in Message Viewer to report false positives.
Alternatively, send the email to NotSpam@marshal.com. Make sure the header info stays intact. This is best done by sending the email in question as an attachment of a new email.
- Do not use "Forward" to send the email.
- Using this address is the least valuable method, because some useful data is lost.

Organizations that use Office 365 can use custom settings for the Microsoft Report button that is available in supported versions of Outlook. For more information about this solution, see article Q21236, Reporting Spam and Phishing to LevelBlue with the Microsoft Report Button.
The previous solution "Trustwave Spam Reporter" continues to work, but this option is deprecated and will be discontinued in the near future.
If you have a copy of the message (for example, in the Data Retention folder), then you can use a button in the Console. In Customer Console > Mail History, search for the email in question. Use the "Spam" button above the history list or in Message Viewer to report the message.
If no other option is possible, you can send the email to Spam@marshal.com. Make sure the header info stays intact. This is best done by sending the email in question as an attachment of a new email.
- Do not use "Forward" to send the email.
- Using this address is the least valuable method, because some useful data is lost.

Blended Threats protection is an additional option available in SEG Cloud.

You can report false positives from the Blended Threat (BTM) Link Validator, or threat URLs that you think should be blocked by BTM.

Submissions are subject to automated and manual processes to improve accuracy of detection.
All submissions are considered and help to improve future detection. LevelBlue cannot provide a personalized response to each submission. LevelBlue does not guarantee filtering of any particular submitted message.
Spam is defined as unsolicited commercial mail.
- Unwanted, but previously solicited, newsletters, marketing messages, mailing lists or auto-notifications are not considered spam and will not be filtered.

MailMarshal Cloud KB article Q20205

Last Modified: July 28, 2026