{"id":1426,"date":"2026-03-26T11:52:33","date_gmt":"2026-03-26T18:52:33","guid":{"rendered":"https:\/\/blogs.pugetsound.edu\/infosec\/?p=1426"},"modified":"2026-03-26T11:52:33","modified_gmt":"2026-03-26T18:52:33","slug":"phishing-from-3-26-26-your-performance-self-evaluation-is-available-for-your-review","status":"publish","type":"post","link":"https:\/\/blogs.pugetsound.edu\/infosec\/the-phish-tank\/1426","title":{"rendered":"Phishing from 3\/26\/26: “Your Performance Self-Evaluation Is Available for Your Review”"},"content":{"rendered":"\n

Original Phishing Message<\/p>\n\n\n\n

From<\/strong>: hradmin[@]neighborhoodshopauction[.]com
Subject<\/strong>: Your Performance Self-Evaluation Is Available for Your Review<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Where did the link lead?<\/p>\n\n\n\n

The link neighborhoodshopauction[.]com\/self-evaluation-form led to content hosted on storage[.]googleapis[.]com. After passing a CAPTCHA-type prompt, you would be taken to a fake Google sign-in page. Always double-check the URL before entering your credentials on a website to ensure it is a trusted site you normally use for the service (e.g. accounts.google.com). If you do not recognize the website or it looks suspicious, do not enter your credentials. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Tips for Detection<\/p>\n\n\n\n

    \n
  • The email was sent from an unexpected domain, neighborhoodshopauction[.]com. Legitimate emails from Human Resources will generally come from a pugetsound.edu email address.<\/li>\n\n\n\n
  • Notice the false sense of urgency. Receiving the email the same day that the evaluations are due should be suspicious. Many phishing emails include urgent timeframes to trick you into acting quickly without thoroughly inspecting the content. <\/li>\n\n\n\n
  • Always investigate links by hovering over or long-tapping. Never enter credentials on sites you do not recognize or on online forms. <\/li>\n<\/ul>\n\n\n\n

    Text of Phishing Message<\/p>\n\n\n\n

    From<\/strong>: hradmin[@]neighborhoodshopauction[.]com
    Subject<\/strong>: Your Performance Self-Evaluation Is Available for Your Review<\/p>\n\n\n\n

    University of Puget Sound \u2014 HR Team Notifications<\/p>\n\n\n\n

    Hi [firstname<\/em>],<\/p>\n\n\n\n

    Your performance evaluation form has been assigned to you for completion.<\/p>\n\n\n\n

    Employee SELF EVALUATIONS are required to be ‘Submitted to Reviewer’ by March 26th.<\/p>\n\n\n\n

    MANAGER EVALUATIONS are required to be ‘Submitted for Approval’ by March 26th.<\/p>\n\n\n\n

    View Review<\/p>\n","protected":false},"excerpt":{"rendered":"

    Original Phishing Message From: hradmin[@]neighborhoodshopauction[.]comSubject: Your Performance Self-Evaluation Is Available for Your Review Where did the link lead? The link neighborhoodshopauction[.]com\/self-evaluation-form led to content hosted on storage[.]googleapis[.]com. After passing a CAPTCHA-type prompt, you would be taken to a fake Google sign-in page. Always double-check the URL before entering your credentials on a website to ensure […]<\/p>\n","protected":false},"author":521,"featured_media":1427,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[3],"class_list":["post-1426","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-phish-tank","tag-phishing"],"_links":{"self":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/1426","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/users\/521"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/comments?post=1426"}],"version-history":[{"count":1,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/1426\/revisions"}],"predecessor-version":[{"id":1430,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/1426\/revisions\/1430"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/media\/1427"}],"wp:attachment":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/media?parent=1426"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/categories?post=1426"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/tags?post=1426"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}