[Scam email] Pressure group pretending to be NHS Vaccination team

[pete]

Just a heads up, since it's probably lurking in school's catch-all mailboxes.

 

We got an email from the (registered 22nd Sep 2021) nhs-vaccines.uk domain pretending to be the NHS Vaccinations team and encouraging our headteacher to send out a vaccination "Consent checklist" to parents.

 

Given the email and checklist's rabidly anti-vax content, I'm not sure what they were expecting to happen.

 

Message title: was [FAO HeadteacherName] Student Consent Checklist for COVID-19 Vaccination

 

Sender address: cvt @ nhs-vaccines.uk

Edited September 27, 2021 by elsiegee40

[tmoon-mint]

Usually when I warn people about this sort of thing I like to be able to show them a copy of the original email. I dont seem to have one in any of my inboxes so could you possibly screnshot one and post it here? Obviously redacting any information needed. Edited September 27, 2021 by tmoon-mint

[3s-gtech]

We're getting lots of them, often mentioning the school's legal liabilities of immunising our students then linking to a load of anti-vax websites.

 

They are all being caught by the spam filter.

[Primus]

We've had it too - it was sent to our enquiries email twice, the first got through to the inbox, the second was caught by Google's spam filter. Edited September 27, 2021 by Primus

[pete]

Usually when I warn people about this sort of thing I like to be able to show them a copy of the original email. I dont seem to have one in any of my inboxes so could you possibly screnshot one and post it here? Obviously redacting any information needed.

 

Email body screenshot attached

 

[TechMonkey]

Sneaky, the domain routes to the NHS vaccines page. Nothing identifying in the Nominet entry either

[bald_pig]

The domain registrar's abuse contact is [email protected]

[elsiegee40]

It’s made BBC news now. Some schools have sent them out

 

Schools warn about hoax anti-vaccine letters

https://www.bbc.co.uk/news/education-58713266

Edited September 27, 2021 by elsiegee40

[jthompson]

We received 10 copies of it to the same mailbox, all within about a minute yesterday.

[paulkerton]

We've now blocked the domain from emailing the school, and I've let the SLT and Office know about the mail itself. Our filters caught it and pushed it to spam both times, but that's what happens with an email that has a URL to click on that's linked to a completely different URL.

 

Complaint going into the registrar now

[hallb15]

I received a copy of the 'checklist' from my daughters' school. It includes a whole page of links to "Official statement verification"

[ITGuyNW]

Our SLT sent it straight out to parents

[ITGuyNW]

Just read on Twitter the domain sending out the letter has been suspended by Kualo.

[paulkerton]

I want to refuse to believe SLTs could fall for it, especially when you read the content and look at the obviously fake logo... but I'm not surprised.

 

Good on Kualo for suspending it.

[tmoon-mint]

Just found another one nhs-vaccinepass.com

 

This one appears to have malware on it.

[paulkerton]

Thanks @tmoon-mint

Not had anything from that address as of yet, but we have blocked the domain in precaution.

[bald_pig]

Just found another one nhs-vaccinepass.com

 

This one appears to have malware on it.

 

Thanks, blocked!

 

*EDIT* Fortigate has already classed it as phishing.

Edited September 30, 2021 by bald_pig

[tmoon-mint]

Thanks @tmoon-mint

Not had anything from that address as of yet, but we have blocked the domain in precaution.

 

Worth blocking it on your filtering too because Sophos wasnt happy when I browsed to it...

 

 

[mthomas08]

HT got it days ago - we blocked it.

Considering how it constantly talks about death and anti vaccines.... everyone should twig..

 

If SLT have fallen victim to this, perhaps remind them about scam emails. Things like this could have opened up your system to ransomware.