Original Phishing Message
Note: This phishing message may have come from a variety of email addresses with differing subject lines depending on the date/time.
From: Prime Notification <xdnpxwa54gwmpdr-eiqnuhknrjv7c8y7[@]d6[.]studiodesing[.]com>
Subject: Your Prime membership is Renewing on Wed, September 18, 2024 8:56 PM
Where did the link lead?
The link in the email goes to a Google Drawing. The link on first glance looks safe since it goes to a familiar legitimate website docs[.]google[.]com/…
However, the Google Drawing contains a link to a fake Amazon login page.
Tips for Detection
- Legitimate notices from Amazon should come from an @amazon[.]com email address. Always check the email address to see if it matches the sender’s display name.
- The randomly generated email address should be suspicious.
- If you are unsure whether an email is from the company it claims to be from, avoid clicking links and go to the company’s known website to check your account.
- Many phishing emails contain links to legitimate cloud services such as Google Docs or Microsoft OneDrive. Use caution when the document/page primarily only consists of directing you to another link. Closely examine the link.
Text of Phishing Message
Note: This phishing message may have come from a variety of email addresses with differing subject lines depending on the date/time.
From: Prime Notification <xdnpxwa54gwmpdr-eiqnuhknrjv7c8y7[@]d6[.]studiodesing[.]com>
Subject: Your Prime membership is Renewing on Wed, September 18, 2024 8:56 PM
Information regarding your payment from Amazon Prime
Hi [username]@pugetsound.edu,
Your Amazon Prime Membership is set to renew on Wed, September 18, 2024 3:01 PM. However, we’ve noticed that the payment method associated with your Prime membership is no longer valid.
To update the default payment method or choose a new one for your membership, please click on the button below and follow the on-screen instructions.
Update Information
Sincerly,
Amazon Prime Team