Do NOT click on the link!

This is a classic phishing scheme - the malicious actor wants the unsuspecting victim who receives the email to click on the link which goes to a Google Drive hosted file that if clicked can create serious vulnerabilities in the victim's device and/or network.

UPDATES:

July 13, 2021 - EDITOR'S NOTE - The bot appears to have switched from ng using Google Drive links to Firebase links. Please report the links to Google using this form. Copy and paste (without clicking) the malicious URL and indicate in your report that it was from an email received from your Website's contact form.  Maybe with enough reports we can get Google to start sniffing these exploits out before they keep spreading more malware!

JUNE 29, 2020:  It is confirmed that this script is also targeting Forms on WordPress websites as well.  Thank you to the users who have contributed to this scam alert in our User Comments!

Why Government, Non Profits, Healthcare Providers, and Political committees should stop holding meetings using Zoom.

Zoom is facing scrutiny over vulnerabilities as it took advantage of the Coronavirus pandemic to quickly become the # 1 Video Conferencing platform in the United States during the COVID-19 Response "Stay at Home" orders and as a remote meeting solution for essential workers who have had to #WorkFromHome.  "Zoombombing" was just the beginning as it was soon discovered over the past month just how vulnerable Zoom actually is.

Phishing is the fraudulent attempt to obtain sensitive information such as usernames, passwords, and credit card details, often for malicious reasons, by disguising as a trustworthy entity in an electronic communication (i.e. email, direct message, SMS, etc).

In both of the phishing emails the senders tried to spoof the SBSD's domain name by sending from [email protected] and [email protected].

It starts as an innocent request from a Chris Thomas for a website quote for naturesfarmproduce.com.  In this case, an email was sent directly to one of my staff.  The subject was "Design !".  The first message, from [email protected], was simple: "I will like to know if you do Web design and please do you accept credit card ?"

The California Consumer Privacy Act (CCPA) is a new data privacy law which applies to certain businesses whom collect personal information from California residents. The new law goes into effect on January 1, 2020. Even if your business is not located in California, some of your visitors might be.

Update: 02/02/2020:

I recently posted a "Part 2" of this Website Quote Request Phishing Scam Alert to the Internet Safety blog.  The scam continues and has evolved.  This time it's a new business, new sender, and a new tactic.  Read the blog post here for more details.

Update: 10/05/2017:

I received a call today from another service provider who has been contacted by this scammer.  Be aware that this scam is still ongoing.  Feel free to share your similar experience or story in the comments section below (as well as if the scammer uses a different name, email address, or changes some of the information).

With more and more "social networking" websites emerging every day comes more and more scams and compromised security.  It is becoming more difficult for the average Internet user to tell whether or not certain websites are legitimate, and even legitimate websites get hacked.

Update: September 16th, 2013:

We have received a great deal of feedback on this post.  I am thankful that this information has helped a lot of people and protected people from being taken advantage of by these scammers.  

Christopher Laursen with European Domain Centre sent me this link and asked me to share it.  It has additional information about this particular scam, including a list of senders.

Please feel free to continue to leave comments with your updates on this post.  We have the comments set to be approved before they show up because of the high volume of spam this particular post receives (most of it originating from the People's Republic of China...coincidence?)