All, A SBL notification phishing campaign has been reported to us. Just wanted to FYI the list so they could keep an eye on mail flows to make sure no one gets owned by a bogus phishing message. Obvious phishing rules apply here with the message and they aren't even trying to spoof spamhaus.org. Looks like it is a download to a .zip which has VBS file in it. Here is an example:
From: Date : 31 January 2020 00:12 To: Objet : URGENT ATTENTION - SBL #FUGTQ52ON SBL Information: Email: Your Email address found in Spamhaus Blacklist (SBL) ------------------------------------------------------------------------ SBL#84445 - The Spamhaus Project - SBL International Anti-Spam Systems ------------------------------------------------------------------------ Good afternoon, It is an automatic letter sourced from Spamhaus Block List (SBL) instance to inform you that this Email just below has actually been included in sbl.spamhaus.org: Issue: phishing spam supplier SBL Ref: SBL97962 Our servers have discovered emailing of a variety of spam letters off of your own email address. Consequently, we have been forced to suspend your e-mail. It's very important to fix the issue within 48 hours. You should do a couple of actions to do it. We're going to attach the guide: GET THE INSTRUCTION: https:XXX//drive.google.com/[Redacted] PASSWORD: S9823 In case you pay no attention to this letter, we'll suppose that this email doesn't belong to you and it's programmed to perform junk mailings. This simply means, that we'll be forced to add your e-mail address to our stop list. This means that recipients will not be able to accept emails from this address ; your email tend to be blocked forever. SBL System Robot The Spamhaus Project https://www.spamhaus.org Thanks, Matt Stith _______________________________________________ mailop mailing list [email protected] https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
