Spammers abusing Google Analytics reports

Every week or so I get an email like this: $SPAMMER has sent you a Google Analytics report The substance of the email is, let’s just say, not ideal: Hi, Attached is your <spam URL> <spam URL> <spam URL> property. VIEW REPORT Note: This email is setup by a user, not Google Analytics. Please reach out to the admin of the property if you have questions on why you’re receiving this email. You can check out a screenshot here, though note it’s NSFW, and you should definitely not visit any of the links. The email includes an attachment that’s legitimately from Google, but there’s no data whatsoever. The only thing mail merged into the template is that fake name, which appears as a truncated URL. I used Google Analytics briefly in… 2006? I suppose I should get around to deleting my account. But I’m unsurprised that a feature designed to send unsolicited reports is being used for spam. How else did the designers expect it to be used? By Ruben Schade in Sydney, 2026-07-10.