Somebody forwards a suspicious message and asks whether it is real. The useful first question is not whether it is phishing, but who else received it.

Delivery history answers that in one request. A message sent to one person is usually sent to several, and the reporter is the one who noticed rather than the only target.

Whether anybody acted on it is the second question, and it changes the response entirely.

Before you begin

Get the sender’s address and roughly when it arrived. The reporter has both.

Ask the reporter directly whether they clicked anything or entered a password. People volunteer this if asked plainly and not if left to mention it.

Find who else got it

1. Ask Avvi for the delivery history for that sender across the client, over the period.
2. Note who received it and whether any copies were held by the filter.
3. If anybody entered credentials, treat that account as compromised and contain it first.
4. Ask Avvi for the inbox rules and forwarding status of anybody who did.
5. Check whether any held copies should stay held.

Delivery history reaches back about ninety days, but defaults to the last two days when no period is given. Quarantine reaches as far as that client’s own retention policy.

Good to know

A message that was delivered is not necessarily read, and a message quarantined is not necessarily unseen if somebody released it.

If several people received it and only one reported it, the others are worth telling. That is a conversation with the client rather than an action in Avvi.

Verify it worked

Confirm you know the full recipient list rather than the reported one.

For anybody who interacted with it, confirm the containment steps completed and no rules or forwarding remain.

If something doesn’t look right

If the sender’s address returns nothing, check the spelling and widen the time range. A display name is not an address.

If the message is older than the quarantine window, the delivery history may still show what happened even though the message itself cannot be examined.

If the same sender keeps appearing, that is a filtering conversation with the client rather than a per-message response.

To escalate, open a support conversation from the Help drawer with the client, the sender’s exact address, the date, and who received it.

FAQ

Q: Should I check the message content?

A: The delivery record covers who, when and the outcome. Judging the message itself is done from the copy the reporter forwarded.

Q: Somebody entered their password.

A: Treat the account as compromised and contain it before anything else.

Q: How far back can I look?

A: Delivery history reaches about ninety days. Quarantine depends on the client’s retention policy rather than an Avvi limit.