Sent: Thursday, June 22, 2017 2:59:07 PM
Subject: PSU MAIL UPDATE…
From: “Pennsylvania State University Support.” <W809018@usm.edu>
To: “;'” <W809018@usm.edu>
Sent: Tuesday, June 20, 2017 11:22:18 AM
Subject: Payroll schedule message.
1 New Notification Regarding Your 2017 Payroll
http://www.psu.edu/h/payr0ll/2017/f0rmspdf. [<– Link text is not the actual address. It goes to a fake WebAccess login in the beecompliant.net domain]
The Pennsylvania State University.
From: “PennState Webmail” <email@example.com>
Date: Tue, Jun 20, 2017 08:16 AM
Subject: Verify your account.
You have 1 important mail alert!
We strongly advise you should update your account and resolve the problem.
Click here [<– Link leads to a fake WebAccess page in the specialitapizzimenti.com domain] to proceed
Failure to do this will lead to your account been suspended or de-activated.
Thanks for your co-operation.
PennState WebMail! Account Services
From: “xxxxxxxxx (xxxxxxxxx)” <firstname.lastname@example.org>
Sent: Monday, June 19, 2017 1:12:57 PM
Subject: psu.edu UPDATE
Dear psu.edu User,
This is to inform you that psu.edu security center is shutting down some accounts due to congestion. This notification has been sent regardless of your last login date and you are required to access your account by clicking the link below to confirm usage and enjoy uninterrupted services.
Notification Date: June 19th, 2017
To update your services; Click UPDATE [<– Link leads to a fake Zimbra login page in the 000webhostapp.com domain]
The Account Update Team at psu.edu Mail! thank you for being on the network and apologize for any inconvenience caused.
ABOUT THIS MESSAGE:
This service message was delivered to you as a psu.edu Mail ! customer to provide you with account updates and information about your account benefits.
From: “PennState Webmail” <email@example.com>
Sent: Thursday, June 15, 2017 9:20:20 AM
Subject: Sign in Security.
Your account was access from another location, Kindly Click Verify Now [<–Link leads to a fake WebAccess page in the specialitapizzimenti.com domain] to confirm your IP.