Original Phishing Message

Note: This phishing message may have come from a variety of email addresses with differing subject lines depending on the date/time.

From: Prime Notification <xdnpxwa54gwmpdr-eiqnuhknrjv7c8y7[@]d6[.]studiodesing[.]com>
Subject: Your Prime membership is Renewing on Wed, September 18, 2024 8:56 PM

Where did the link lead?

The link in the email goes to a Google Drawing. The link on first glance looks safe since it goes to a familiar legitimate website docs[.]google[.]com/…

However, the Google Drawing contains a link to a fake Amazon login page.

Tips for Detection

  • Legitimate notices from Amazon should come from an @amazon[.]com email address. Always check the email address to see if it matches the sender’s display name.
  • The randomly generated email address should be suspicious.
  • If you are unsure whether an email is from the company it claims to be from, avoid clicking links and go to the company’s known website to check your account.
  • Many phishing emails contain links to legitimate cloud services such as Google Docs or Microsoft OneDrive. Use caution when the document/page primarily only consists of directing you to another link. Closely examine the link.

Text of Phishing Message

Note: This phishing message may have come from a variety of email addresses with differing subject lines depending on the date/time.

From: Prime Notification <xdnpxwa54gwmpdr-eiqnuhknrjv7c8y7[@]d6[.]studiodesing[.]com>
Subject: Your Prime membership is Renewing on Wed, September 18, 2024 8:56 PM

Information regarding your payment from Amazon Prime

Hi [username]@pugetsound.edu,

Your Amazon Prime Membership is set to renew on Wed, September 18, 2024 3:01 PM. However, we’ve noticed that the payment method associated with your Prime membership is no longer valid.

To update the default payment method or choose a new one for your membership, please click on the button below and follow the on-screen instructions.

Update Information

Sincerly,
Amazon Prime Team