Shifty subpoena email doing the rounds
A phishing email is circulating across NZ pretending to be a District Court subpoena, pushing you to open a PDF attachment from the pt.lu domain.
You might receive a plain text email that looks like a legal notice from the District Court of New Zealand. The subject line seen is 'District Court of New Zealand (Te Kōti-ā-Rohe) : SUBPOENA-NZGOVDOC001.PDF', and it urges you to review an attached PDF subpoena. It is designed to feel formal and urgent, so you act before thinking.
What gives it away is that the message does not line up cleanly behind the scenes. It passed some basic checks, but it also failed SPF, which means the sending server was not authorised to send on behalf of the domain it claimed. The sender domain, pt.lu, also does not fit a genuine New Zealand court communication, even if the message is dressed up to look official.
The attacker is trying to get you to open the attachment and engage with a fake legal notice. That can lead to credential theft, malware, or a follow-up scam once they know you responded. If someone in your business treats it as genuine, the next step could expose accounts, devices, or sensitive business information.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Warn staff to treat unexpected legal notices by email with caution, especially anything claiming to be a subpoena or court document.
- Verify: Confirm any supposed court communication through official District Court contact details sourced independently, not from the email.
- Do not: Open the PDF attachment, reply to the message, or forward it internally until it has been checked by your IT provider.
- Report: Mark the email as phishing in your mail platform and escalate it to your IT provider for review and blocking.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Ministry of Justice message looks like, the real sender domain, the real link destination, and where to report a fake.