Email with link to blocked site

[Mark_Albrosco]

Note: this topic was originally posted in Home > Research Center > Newest IP or URL Threats and moved to this forum as suggested by David H. Lipman

Malwarebytes Cloud Protection reported a blocked website for one of my users.

Investigation revealed that the user did not browse to the site, but an email received from a supplier contact when opened in the preview pane of Outlook Web Access immediately results in a series of popups from Malwarebytes Endpoint Protection as below:

I checked the URL using

 virustotal.com 

and the results were as follows:

I've attached a zip file containing the email - I'd like it to be analyzed so that I can report what is causing the email to attempt to make an outbound connection. I also intend to contact our supplier and alert them to this issue, so that they can take appropriate action

The following was also reported by Malwarebytes Endpoint Protection in relation to this item

Email-CrossBrowser-blocked.zip