Report: Looker Studio abused for phishing emails

[ian-rybak]

Hello there! I wasn't really sure where to post this, but maybe this community could be able to provide me some assistance.

Beginning November 1, 2024 my personal Gmail account began receiving emails from "looker-studio-noreply@google.com" with subject lines: "🎉 Congratulations! You're Invited to Join Our Exclusive Adult Community! 🎉 - Nov 3, 2024" (or the date I received it). They passed by spam filters and made it to my inbox. The senders as parsed by my mail client show "FirstName LastName (via Looker Studio)", but the reply to email is always "differentfirst.differentlast@domain.domain.domain". I am not using the actual names and domains to prevent any privacy issues.

The content of the email is an Looker Studio scheduled report sent by Google on behalf of some name, always for an "Untitled Report" with some description of a scummy adult website or community, even sometimes with an "invite link". This Untitled_Report.pdf is attached, though I have never dared to open any of them. The bottom of the email contains the usual Looker Studio footer, including the link to unsubscribe from the scheduled email that uses the official optout token. I attempted to just unsubscribe and block the sender using this method, but there are so many now (28 in less than 72 hours) and I gave up. My next step will probably just be a filter that catches any Looker Studio emails and treats them as malicious.

I have not fallen victim to phishing or the links - I did not click any of them except the official Looker Studio optout. I would first of all like to make the community aware that this is being abused by malicious actors. Secondly, as someone who has never used Looker Studio for personal or business reasons, is there any way that I can add my email to a blacklist so that others cannot subscribe me to their reports? They seem to only need my email (which is likely available in any number of breaches). I feel like a complete optout or the requirement that an email have used Looker Studio should be a feature to prevent this misuse of the system against vulnerable individuals who do not catch that the official Google email is from a 3rd party. Seems like this was used in the past for other phishing attempts (2023: (URL Removed by Staff), 2023: (URL Removed by Staff) 2023: (URL Removed by Staff)

Any help would be great, and I can provide more details if that is not in violation of the community guidelines and would prove helpful to improving the product. Thank you!

[webmusher]

View the interactive report: Untitled Report   Welcoming To The Adult Secret Community Only For One Night Dates. Join Now >> (URL Removed by Staff) The Fastest Growing Adult Live Chat Personal Site! This is a fast growing platform where people around you share their nude photos with personal details. See their nude photos & chat with them-> then she is on your bed. Join with them,CLICK HERE >> (URL Removed by Staff)

© 2025 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043 You received this email because someone scheduled it to be sent to you regularly. You can unsubscribe from this scheduled email here. This email and its content are subject to the Looker Studio Terms of Service you have agreed to. If you have not agreed to the Looker Studio Terms of Service, the Google Terms of Service shall apply. This email and its content are also subject to the Google Privacy Policy.

[Starbase101]

Every couple minutes a new spam email from Looker Studio. Ridiculous.

[JenS]

Thank you @Starbase101 - we are taking a look. 

[Starbase101]

That was just a small sample from hundreds of emails. Google must put a stop to this.

[mcgroarty]

Something Google can do right now, today, is to look at what Looker Studio accounts are getting blocked the most. Legitimate Looker Studio users would rarely have hundreds of blocks. So you already have rich data available to you.

Also, the main point of the abuse seems to be providing all the clickable URLs in the initial email. You should revisit whether links on the report emails should be clickable, or you could mine for which domain names are most often associated with blocked accounts.

[Thesoundman]

I have also been receiving unsolicited spam emails beginning in October from users via Looker Studio and even though I have unsubscribed and blocked the senders using the provided link they continue. Seeing as Google will not address this misuse of its app Google is just as culpable as those abusing the app in my opinion, if I had a legal recourse to hold Google accountable for the time I have wasted trying to rid my inbox of these unwanted emails I would most certainly take it.

[Ragnarocek]

Same here... Getting multiple email messages from looker-studio-noreply@google.com every day... it is sooo annoying... nearly 1 year from first report here and the issue is still not solved...

[4238ewasd]

Nothing new, but I'm really surprised there is no "Report abuse" button right on the report you can just click that will auto-terminate the report if multiple people click it. 

(Since it's very common - see https://keepaware.com/blog/looking-for-documents-look-no-further-a-new-trend-in-abusing-google-looke...)

[aklsjdhfkjlasdh]

This is NOT SOLVED

[Laferu]

This is not resolved.
I get this all the time, and I have never used this service. There is no option to remove my email from any Locker Studio messages.

[Thesoundman]

I think it may be time for a class action lawsuit against Google/looker studios...if this is not a breach of the trust we placed in Google when we created our accounts then I do not know what is.

[uriuser]

Me too - An average of 2 new unauthorized subscriptions from bot accounts every 2 working days since 30th December. The go to spam inbox, and I unsubscribe them and block the bot account, but new subscriptions to p*rn spam keep appearing each 2 days. I'm not using Looker Studio for anything at all.

[Starbase101]

Google doesn't care. If they did, this would have been resolved a long time ago. In fact, if their developers were competent, none of the abuse would have even happened in the first place because the software would have been designed to not allow it. Sue them, that will get somebody's attention.

[Ragnarocek]

As this thread is marked as "Solved" I created a new thread: https://www.googlecloudcommunity.com/gc/Looker-Studio/Looker-studio-spam-phishing/m-p/871932#M7277

[BrqD]

I am reporting ALL SPAM to SPAMCOP

[BrqD]

I see the problem is old. I don't even use Looker and I'm getting more and more pornographic

SPAM and Google doesn't seem to care.

Because I am COPYING EACH ONE TO SPAMCOP, marking the message as PHISHING and this will harm anyone who seriously uses the service.
Let Google do its best to keep the service off the blacklists.

*****DO THE SAME: COPY TO SPAMCOP OR OTHER SERVICE AND MARK THE MESSAGES AS PISHING***** - eventually Google will notice.

[spammemore4761]

I flag them as phishing in gmail and so far, that is not stopping them.

[BrqD]

Keep going! If everyone does this, soon ALL messages will go to SPAM and
those who seriously use it will start abandoning the service due to
Google's inactivity to resolve the problem.

[spammemore4761]

This is not solved, received 4 spam messages in the last two days. I would say 0 equals solved.

[4238ewasd]

I have had this same issue for YEARS. I have tried to report, unsubscribe, block email from Google Data Studio. None of it works. There is no option to unsubscribe or block or fix. 

[Starbase101]

There is a new "spam machine" being exploited now by the idiot spammers. For the last two weeks I've now started getting spam phishing emails from Google Forms. I have never used Google Forms just like I have never used Looker Studio. The tool is being abused by spammers, and evidently Google endorses this because 1. the software was not initially coded to prevent this, 2. nobody at Google has done anything to patch the software for preventing the abuse, and 3. people abusing the system have not had their accounts deleted and banned by Google. The key takeaway for me is that Google supports spam, abuse, pornography, phishing, scams, etc. Thank goodness for email filtering and auto-delete.

[mcgroarty]

I've figured it out. Why doesn't the Looker Studio team fix the spam problem? Simple: If they did, the Google executives would discover that Looker Studio usage isn't 1% of what today's metrics suggest.

It's a perverse incentive. Internally, allowing the spam to continue makes Looker Studio look more successful.