{"id":1319,"date":"2024-11-22T11:23:35","date_gmt":"2024-11-22T19:23:35","guid":{"rendered":"https:\/\/blogs.pugetsound.edu\/infosec\/?p=1319"},"modified":"2024-11-22T11:23:37","modified_gmt":"2024-11-22T19:23:37","slug":"phishing-from-11-18-2024-your-email-suspension-notification-received","status":"publish","type":"post","link":"https:\/\/blogs.pugetsound.edu\/infosec\/the-phish-tank\/1319","title":{"rendered":"Phishing from 11\/18\/2024: “Your Email Suspension-notification Received”"},"content":{"rendered":"\n

Original Phishing Message<\/p>\n\n\n\n

From<\/strong>: shizusan[@]sky[.]plala[.]or[.]jp
Subject<\/strong>: Your Email Suspension-notification Received 33bd7b2a52119311bcc14d54f682a043|12:12:52 AM<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Where did the link lead?<\/p>\n\n\n\n

The link led to a fake website hosted on storage[.]bunnycdn[.]com mimicking the main pugetsound.edu website. The fake website is designed to steal your password. Never enter your password on sites you do not recognize. Always investigate links before clicking and\/or check the URL bar in your browser to confirm what website you are visiting.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Tips for Detection<\/p>\n\n\n\n

  • The email is coming from a suspicious email address, shizusan[@]sky[.]plala[.]or[.]jp. <\/li>
  • Notice that “Puget Sound” is spelled “Pugetsound” in the email and on the phishing site. <\/li>
  • Technology Services will not ask you to click a link in an email to re-activate your email account. Beware of urgent emails attempting to impersonate the IT department. <\/li><\/ul>\n\n\n\n

    Text of Phishing Message<\/p>\n\n\n\n

    From<\/strong>: shizusan[@]sky[.]plala[.]or[.]jp
    Subject<\/strong>: Your Email Suspension-notification Received 33bd7b2a52119311bcc14d54f682a043|12:12:52 AM <\/p>\n\n\n\n

    Mailbox Notification!<\/p>\n\n\n\n

    Dear [username removed<\/em>],<\/p>\n\n\n\n

    You have some incoming messages that are placed on hold-([username<\/em>]@pugetsound.edu), due to mailbox upgrades.<\/p>\n\n\n\n

    Kindly RE-ACTIVATE your account below to access incoming messages 11\/19\/2024.<\/p>\n\n\n\n

    RE-ACTIVATE HERE<\/p>\n\n\n\n

    Failure to re-activate your mailbox might lead to suspension.<\/p>\n\n\n\n

    Best Regards<\/p>\n\n\n\n

    Pugetsound Administrator.<\/p>\n\n\n\n

    \u00a9 2024 pugetsound.edu Administrator. All Rights Reserved.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Original Phishing Message From: shizusan[@]sky[.]plala[.]or[.]jpSubject: Your Email Suspension-notification Received 33bd7b2a52119311bcc14d54f682a043|12:12:52 AM Where did the link lead? The link led to a fake website hosted on storage[.]bunnycdn[.]com mimicking the main pugetsound.edu website. The fake website is designed to steal your password. Never enter your password on sites you do not recognize. Always investigate links before clicking […]<\/p>\n","protected":false},"author":521,"featured_media":1320,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[3,4],"class_list":["post-1319","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-phish-tank","tag-phishing","tag-phishtank"],"_links":{"self":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/1319","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/users\/521"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/comments?post=1319"}],"version-history":[{"count":1,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/1319\/revisions"}],"predecessor-version":[{"id":1322,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/1319\/revisions\/1322"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/media\/1320"}],"wp:attachment":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/media?parent=1319"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/categories?post=1319"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/tags?post=1319"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}