Phishing Example 88: Important account information update

Received March 2015


From: University of Minnesota <xxxxxx@georgetown.edu>
Date: Thu, Mar 5, 2015 at 1:38 PM
Subject: Important account information update
To:

 
*Hello University Members,*
 
You are required to update your University of Minnesota account information
due to recent update in our database. Please follow the link below to
update your account information.
 
University of Minnesota Account Update
<hxxp://xxxxx.es/includes/db/umn/access_web.htm>
 
Regards,

The University of Minnesota

Things to note:

• URL is NOT from "umn.edu," - it's hosted in Spain.
• VERY good copy of current login page
• IF a person fills it out, it redirects to myu.umn.edu and will show you what appears to be the same login page. Users will probably assume they mistyped their password and re-enter it, THEN get a successful login.