Phishing Example 64: Validate Now (also "Validate", "I T Service")

Received September 2014

Message text:

   From: UMN Admin <xxxxxxxxxxxxxxx@york.ac.uk>
   Date: Mon, Sep 8, 2014 at 9:14 AM
   Subject: Validate now
   To:
   Dear umn user,
   validate umn.edu <hxxp://some-home-domain.NOT.UMN.EDU/validate.umn.edu/>

Things to note:

• Sign in page resembles, but not identical to login page
• Top bar links and search bar are IMAGES, not active
• Not hosted at UMN.EDU - tricky use of "validate.umn.edu" as the end of the URL, but domain is actually at a ".cc" home.