Hi, We're currently experiencing a new spam campaign that involves some text pertaining to invoicing then a link that immediately downloads a Word macro file.
http://sdeflores.com/PHJC579907/ What would be involved in following these links in SA to determine if they immediately download a file (other than a web page)? Would that even be a reliable indicator? This isn't the first time I've seen such an approach. This one's probably already on some blacklists, but I'm still blocking others: https://pastebin.com/p7EnFNf7 Thanks, Alex
