Example 161: Please Check

Fake UMN login page hosted in India - Received October 2016

Things to note:

• Email claims to be from a (non-existent) umn.edu address "details"
• Email really sent from a umn.edu user account that was hijacked/compromised
• Link in email appears to go to a umn.edu address - real link goes to a website in India
• "Unread Email" message IS NOT SOMETHING UMN email ever sends.

MESSAGE TEXT:

From: UMN <details @ umn.edu> <compromised UMN account>Date: Mon, Oct 10, 2016 at 6:42 AM
Subject: Please Check
To:

Dear UMN user,
You have an unread emails on your inbox. Please login below to receive this email.
http://web.umn.edu/login

© 2016 Regents of the University of Minnesota. All rights reserved.     

EMAIL SENDS USERS TO A FAKE UMN.EDU LOGIN:

As noted - copy of University login is actually hosted in India (".in" ending in the address).