Lots of emails with https://bit.ly/3izj6gx links passing our CES

[RolandBaumgaertner72768]

hello,

today one user got an email from a hotmail account with direct link https://bit.ly/3izj6gx.

He told me he didnt click on the link but since then, maybe more 30 users get a similiar message.

Is there any way we can manualy create a rule to stop this? I am afraid that all our users get more and more emails from this type.

Thanks in advance,

Roland

 

[SriramV]

this is a malware URL. ESA should have bought it. if url reputation filter is configured, it would have caught. 

Mon Jun 14 12:56:00 2021 Info: MID 51832 interim verdict using engine: CASE spam positive

Mon Jun 14 12:56:00 2021 Info: MID 51832 URL h*** : // ljzl. skysafe. run / apmix has reputation -6.5 matched Condition: URL Reputation Rule

if not configured, then follow "https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118775-technote-esa-00.html"