Due to the huge number of variants in the wild, our AV software can't
keep up (probably nobody's can). Instead, we enabled a global rule which
blocks any email from accounts such as billing, root, postmaster,
antivirus, abuse, security, etc. which don't originate from our
management IP space where our people work. As a result, we have stopped
these phishing scams for our users dead in their tracks.