Original Phishing Message

From: shizusan[@]sky[.]plala[.]or[.]jp
Subject: Your Email Suspension-notification Received 33bd7b2a52119311bcc14d54f682a043|12:12:52 AM

Where did the link lead?

The link led to a fake website hosted on storage[.]bunnycdn[.]com mimicking the main pugetsound.edu website. The fake website is designed to steal your password. Never enter your password on sites you do not recognize. Always investigate links before clicking and/or check the URL bar in your browser to confirm what website you are visiting.

Tips for Detection

  • The email is coming from a suspicious email address, shizusan[@]sky[.]plala[.]or[.]jp.
  • Notice that “Puget Sound” is spelled “Pugetsound” in the email and on the phishing site.
  • Technology Services will not ask you to click a link in an email to re-activate your email account. Beware of urgent emails attempting to impersonate the IT department.

Text of Phishing Message

From: shizusan[@]sky[.]plala[.]or[.]jp
Subject: Your Email Suspension-notification Received 33bd7b2a52119311bcc14d54f682a043|12:12:52 AM

Mailbox Notification!

Dear [username removed],

You have some incoming messages that are placed on hold-([username]@pugetsound.edu), due to mailbox upgrades.

Kindly RE-ACTIVATE your account below to access incoming messages 11/19/2024.

RE-ACTIVATE HERE

Failure to re-activate your mailbox might lead to suspension.

Best Regards

Pugetsound Administrator.

© 2024 pugetsound.edu Administrator. All Rights Reserved.