I assume they use someone else’s list and catbox was used to deliver malware beyond some threshold in the past.