{"id":1276,"date":"2024-09-18T09:00:38","date_gmt":"2024-09-18T16:00:38","guid":{"rendered":"https:\/\/blogs.pugetsound.edu\/infosec\/?p=1276"},"modified":"2024-09-18T09:03:30","modified_gmt":"2024-09-18T16:03:30","slug":"phishing-from-9-18-2024-your-prime-membership-is-renewing-on-wed-september-18-2024","status":"publish","type":"post","link":"https:\/\/blogs.pugetsound.edu\/infosec\/the-phish-tank\/1276","title":{"rendered":"Phishing from 9\/18\/2024: “Your Prime membership is Renewing on Wed, September 18, 2024”"},"content":{"rendered":"\n

Original Phishing Message<\/p>\n\n\n\n

Note: This phishing message may have come from a variety of email addresses with differing subject lines depending on the date\/time.<\/em><\/p>\n\n\n\n

From<\/strong>: Prime Notification <xdnpxwa54gwmpdr-eiqnuhknrjv7c8y7[@]d6[.]studiodesing[.]com>
Subject:<\/strong> Your Prime membership is Renewing on Wed, September 18, 2024 8:56 PM<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Where did the link lead?<\/p>\n\n\n\n

The link in the email goes to a Google Drawing. The link on first glance looks safe since it goes to a familiar legitimate website docs[.]google[.]com\/…<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

However, the Google Drawing contains a link to a fake Amazon login page.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Tips for Detection<\/p>\n\n\n\n

  • Legitimate notices from Amazon should come from an @amazon[.]com email address. Always check the email address to see if it matches the sender’s display name. <\/li>
  • The randomly generated email address should be suspicious. <\/li>
  • If you are unsure whether an email is from the company it claims to be from, avoid clicking links and go to the company’s known website to check your account. <\/li>
  • Many phishing emails contain links to legitimate cloud services such as Google Docs or Microsoft OneDrive. Use caution when the document\/page primarily only consists of directing you to another link. Closely examine the link.<\/li><\/ul>\n\n\n\n

    Text of Phishing Message<\/p>\n\n\n\n

    Note: This phishing message may have come from a variety of email addresses with differing subject lines depending on the date\/time.<\/em><\/p>\n\n\n\n

    From<\/strong>: Prime Notification <xdnpxwa54gwmpdr-eiqnuhknrjv7c8y7[@]d6[.]studiodesing[.]com>
    Subject:<\/strong> Your Prime membership is Renewing on Wed, September 18, 2024 8:56 PM<\/p>\n\n\n\n

    Information regarding your payment from Amazon Prime<\/p>\n\n\n\n

    Hi [username<\/em>]@pugetsound.edu,<\/p>\n\n\n\n

    Your Amazon Prime Membership is set to renew on Wed, September 18, 2024 3:01 PM. However, we’ve noticed that the payment method associated with your Prime membership is no longer valid.<\/p>\n\n\n\n

    To update the default payment method or choose a new one for your membership, please click on the button below and follow the on-screen instructions.<\/p>\n\n\n\n

    Update Information<\/p>\n\n\n\n

    Sincerly,
    Amazon Prime Team<\/p>\n\n\n\n

    <\/p>\n","protected":false},"excerpt":{"rendered":"

    Original Phishing Message Note: This phishing message may have come from a variety of email addresses with differing subject lines depending on the date\/time. From: Prime Notification <xdnpxwa54gwmpdr-eiqnuhknrjv7c8y7[@]d6[.]studiodesing[.]com>Subject: Your Prime membership is Renewing on Wed, September 18, 2024 8:56 PM Where did the link lead? The link in the email goes to a Google Drawing. […]<\/p>\n","protected":false},"author":521,"featured_media":1277,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[3],"class_list":["post-1276","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-phish-tank","tag-phishing"],"_links":{"self":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/1276","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/users\/521"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/comments?post=1276"}],"version-history":[{"count":2,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/1276\/revisions"}],"predecessor-version":[{"id":1281,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/1276\/revisions\/1281"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/media\/1277"}],"wp:attachment":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/media?parent=1276"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/categories?post=1276"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/tags?post=1276"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}