Cisco Cyber Scam E-mail

danny069

Beware of this email guys and girls, I got this today, it's a scam, especially since all of the excitement of the cisco cyber scholarship going around, I removed the full links so no one clicks on them:

"Lumicybersecurity Support <noreply@lumicybersecurity.com>
3:04 PM (32 minutes ago)


to me
Hi First Name Last Name,


A new account has been created for you at 'Cisco Cyber Security'
and you have been issued with a new temporary password.


Your current login information is now:
username: firstname.lastname@gmail.com
password: +w5s$Ia:;3
(you will have to change your password
when you login for the first time)


To start using 'Cisco Cyber Security', login at
http://ec2-54-149-220-207.?.?


In most mail programs, this should appear as a blue link
which you can just click on. If that doesn't work,
then cut and paste the address into the address
line at the top of your web browser window.


Cheers from the 'Cisco Cyber Security' administrator,


Lumicybersecurity Support
support at t2000inc.?
http://ccs-totara-1756017806.?.?&quot;

E Double U

Now you tell me.

NetworkNewb

I thought it was little weird that Cisco would ask me for my PIN number... dammit

cyberguypr

The only thing strange here is that they are using the exact same random password I use for all my bank accounts. What a coincidence!

Cyberscum

Dammit danny69.

Gonna have to go back to using my Nigerian money transfer email again.

Thanks for ruining the fun

desiree95

wait, so is the scholarship program real or not? this got me lost, i dont even know the password i used when I changed my cisco password.

danny069

The program is real, this e-mail is not, just making people aware.

egb893

It's not a scam email, just an email sent in error. I received the email posted here and just received a follow up email.

Dear Scholarship Applicants,

We’ve been alerted that you may have received an email with new login credentials to the Cisco Cybersecurity site, please disregard this email. If you have completed your prequalification assessment your login credentials were removed today and this email was generated in error. You will hear from Cisco within the next couple weeks with an update on the scholarship status. All users who receive the scholarship will receive new credentials at a later date.

Please note this email is not an indicator of scholarship status.

Thank you,

Sabrina Moore

liz4rd

Not a scam. Was just sent out in error.

The email is actually from Cisco

danny069

It is a scam email guys. They sent a "follow up" email to set your mind at ease to make it seem like it is legit. I received a real email from Cisco today saying they have my assessment, cmon Sabrina Moore? really?

danny069

Let's examine the header:


Delivered-To: danny.xxx@gmail.comReceived: by 10.79.118.12 with SMTP id r12csp1170996ivc; Mon, 12 Sep 2016 12:04:21 -0700 (PDT)X-Received: by 10.66.155.129 with SMTP id vw1mr35678718pab.148.1473707061803; Mon, 12 Sep 2016 12:04:21 -0700 (PDT)Return-Path: <support@t2000inc.zendesk.com>Received: from ip-172-31-11-18.us-west-2.compute.internal (ec2-54-149-220-207.us-west-2.compute.amazonaws.com. [54.149.220.207]) by mx.google.com with ESMTP id 19si22861244pft.165.2016.09.12.12.04.21 for <danny.xxx@gmail.com>; Mon, 12 Sep 2016 12:04:21 -0700 (PDT)Received-SPF: softfail (google.com: domain of transitioning [email]support@t2000inc.zendesk.com does not designate 54.149.220.207 as permitted sender) client-ip=54.149.220.207;Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning [/email][email]support@t2000inc.zendesk.com does not designate 54.149.220.207 as permitted sender) smtp.mailfrom=support@t2000inc.zendesk.comReceived: by ip-172-31-11-18.us-west-2.compute.internal (Postfix, from userid 33) id F3C1527B64; Mon, 12 Sep 2016 19:04:26 +0000 (UTC)To: "Danny069 at Techexams" <danny.xxx@gmail.com>Subject: Cisco Cyber Security: New user accountX-PHP-Originating-Script: 33:class.phpmailer.phpDate: Mon, 12 Sep 2016 15:04:26 -0400From: "Lumicybersecurity Support" <noreply@lumicybersecurity.com>Reply-To: "Lumicybersecurity Support" <support@t2000inc.zendesk.com>Message-ID: <a23a36c6ec9221e152e9e7fa90103680@ip-172-31-2-34>X-Priority: 3X-Mailer: PHPMailer Totara 2015051107 (https://github.com/PHPMailer/PHPMailer/)MIME-Version: 1.0Content-Type: text/plain; charset=UTF-8Content-Transfer-Encoding: 8bitThe source IP address is from Amazon Web Services, from Portland Oregon. It just does not seem legit to me. I know I would not login again when I already have.[/email]

NetworkNewb

danny069 wrote: »

It is a scam email guys. They sent a "follow up" email to set your mind at ease to make it seem like it is legit. I received a real email from Cisco today saying they have my assessment, cmon Sabrina Moore? really?

Are you saying Sabrina Moore isn't real? From this reddit thread it sounds like Sabrina has responded to individual emails they have sent in.

https://www.reddit.com/r/ccna/comments/51k6o0/cisco_cybersecurity_scholarship_program_assessment/

danny069

I compared the headers of the legit cisco email and they do not match up. No where in this header do I see cisco.com, the legit e-mail does. A lot of people will get their usernames and passwords stolen.

chrisone

So you mean to tell me I didn't have to send that $1000 to the prince of Nigeria?

Cyberscum

This is interesting. I just got one too.

It looks like it has already been covered before.


https://goo.gl/Suz3T6

PJ_Sneakers

I wonder how everyone's email got out. Did they send an email with a huge CC on it?

egb893

Interesting, yesterday the link in the possible scam email forwarded to lumicybersecurity site. Tried it again right now and it's stays on the aws site but looks like the the lumicybersecurity site. The lumicybersecurity site is the site we took the exam on. I still don't think it's a scam email and I wouldn't put it in spam or block it.