Cisco Cyber Scam E-mail

danny069danny069 Member Posts: 1,025 ■■■■□□□□□□
Beware of this email guys and girls, I got this today, it's a scam, especially since all of the excitement of the cisco cyber scholarship going around, I removed the full links so no one clicks on them:

"Lumicybersecurity Support <noreply@lumicybersecurity.com>
3:04 PM (32 minutes ago)


to me
Hi First Name Last Name,


A new account has been created for you at 'Cisco Cyber Security'
and you have been issued with a new temporary password.


Your current login information is now:
username: firstname.lastname@gmail.com
password: +w5s$Ia:;3
(you will have to change your password
when you login for the first time)


To start using 'Cisco Cyber Security', login at
http://ec2-54-149-220-207.?.?


In most mail programs, this should appear as a blue link
which you can just click on. If that doesn't work,
then cut and paste the address into the address
line at the top of your web browser window.


Cheers from the 'Cisco Cyber Security' administrator,


Lumicybersecurity Support
support at t2000inc.?
http://ccs-totara-1756017806.?.?&quot;
I am a Jack of all trades, Master of None

Comments

  • E Double UE Double U Member Posts: 2,228 ■■■■■■■■■■
    Now you tell me.
    Alphabet soup from (ISC)2, ISACA, GIAC, EC-Council, Microsoft, ITIL, Cisco, Scrum, CompTIA, AWS
  • NetworkNewbNetworkNewb Member Posts: 3,298 ■■■■■■■■■□
    I thought it was little weird that Cisco would ask me for my PIN number... dammit
  • cyberguyprcyberguypr Mod Posts: 6,928 Mod
    The only thing strange here is that they are using the exact same random password I use for all my bank accounts. What a coincidence!
  • CyberscumCyberscum Member Posts: 795 ■■■■■□□□□□
    Dammit danny69.

    Gonna have to go back to using my Nigerian money transfer email again.

    Thanks for ruining the fun
  • desiree95desiree95 Registered Users Posts: 4 ■□□□□□□□□□
    wait, so is the scholarship program real or not? this got me lost, i dont even know the password i used when I changed my cisco password.
  • danny069danny069 Member Posts: 1,025 ■■■■□□□□□□
    The program is real, this e-mail is not, just making people aware.
    I am a Jack of all trades, Master of None
  • egb893egb893 Member Posts: 20 ■■■□□□□□□□
    It's not a scam email, just an email sent in error. I received the email posted here and just received a follow up email.

    Dear Scholarship Applicants,

    We’ve been alerted that you may have received an email with new login credentials to the Cisco Cybersecurity site, please disregard this email. If you have completed your prequalification assessment your login credentials were removed today and this email was generated in error. You will hear from Cisco within the next couple weeks with an update on the scholarship status. All users who receive the scholarship will receive new credentials at a later date.

    Please note this email is not an indicator of scholarship status.

    Thank you,

    Sabrina Moore
  • liz4rdliz4rd Member Posts: 51 ■■□□□□□□□□
    Not a scam. Was just sent out in error.

    The email is actually from Cisco
  • danny069danny069 Member Posts: 1,025 ■■■■□□□□□□
    It is a scam email guys. They sent a "follow up" email to set your mind at ease to make it seem like it is legit. I received a real email from Cisco today saying they have my assessment, cmon Sabrina Moore? really?
    I am a Jack of all trades, Master of None
  • danny069danny069 Member Posts: 1,025 ■■■■□□□□□□
    Let's examine the header:


    Delivered-To: danny.xxx@gmail.comReceived: by 10.79.118.12 with SMTP id r12csp1170996ivc; Mon, 12 Sep 2016 12:04:21 -0700 (PDT)X-Received: by 10.66.155.129 with SMTP id vw1mr35678718pab.148.1473707061803; Mon, 12 Sep 2016 12:04:21 -0700 (PDT)Return-Path: <support@t2000inc.zendesk.com>Received: from ip-172-31-11-18.us-west-2.compute.internal (ec2-54-149-220-207.us-west-2.compute.amazonaws.com. [54.149.220.207]) by mx.google.com with ESMTP id 19si22861244pft.165.2016.09.12.12.04.21 for <danny.xxx@gmail.com>; Mon, 12 Sep 2016 12:04:21 -0700 (PDT)Received-SPF: softfail (google.com: domain of transitioning [email]support@t2000inc.zendesk.com does not designate 54.149.220.207 as permitted sender) client-ip=54.149.220.207;Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning [/email][email]support@t2000inc.zendesk.com does not designate 54.149.220.207 as permitted sender) smtp.mailfrom=support@t2000inc.zendesk.comReceived: by ip-172-31-11-18.us-west-2.compute.internal (Postfix, from userid 33) id F3C1527B64; Mon, 12 Sep 2016 19:04:26 +0000 (UTC)To: "Danny069 at Techexams" <danny.xxx@gmail.com>Subject: Cisco Cyber Security: New user accountX-PHP-Originating-Script: 33:class.phpmailer.phpDate: Mon, 12 Sep 2016 15:04:26 -0400From: "Lumicybersecurity Support" <noreply@lumicybersecurity.com>Reply-To: "Lumicybersecurity Support" <support@t2000inc.zendesk.com>Message-ID: <a23a36c6ec9221e152e9e7fa90103680@ip-172-31-2-34>X-Priority: 3X-Mailer: PHPMailer Totara 2015051107 (https://github.com/PHPMailer/PHPMailer/)MIME-Version: 1.0Content-Type: text/plain; charset=UTF-8Content-Transfer-Encoding: 8bitThe source IP address is from Amazon Web Services, from Portland Oregon. It just does not seem legit to me. I know I would not login again when I already have.[/email]
    I am a Jack of all trades, Master of None
  • NetworkNewbNetworkNewb Member Posts: 3,298 ■■■■■■■■■□
    danny069 wrote: »
    It is a scam email guys. They sent a "follow up" email to set your mind at ease to make it seem like it is legit. I received a real email from Cisco today saying they have my assessment, cmon Sabrina Moore? really?

    Are you saying Sabrina Moore isn't real? From this reddit thread it sounds like Sabrina has responded to individual emails they have sent in.

    https://www.reddit.com/r/ccna/comments/51k6o0/cisco_cybersecurity_scholarship_program_assessment/
  • danny069danny069 Member Posts: 1,025 ■■■■□□□□□□
    I compared the headers of the legit cisco email and they do not match up. No where in this header do I see cisco.com, the legit e-mail does. A lot of people will get their usernames and passwords stolen.
    I am a Jack of all trades, Master of None
  • chrisonechrisone Member Posts: 2,278 ■■■■■■■■■□
    So you mean to tell me I didn't have to send that $1000 to the prince of Nigeria? icon_lol.gif
    Certs: CISSP, EnCE, OSCP, CRTP, eCTHPv2, eCPPT, eCIR, LFCS, CEH, SPLK-1002, SC-200, SC-300, AZ-900, AZ-500, VHL:Advanced+
    2023 Cert Goals: SC-100, eCPTX
  • CyberscumCyberscum Member Posts: 795 ■■■■■□□□□□
    This is interesting. I just got one too.

    It looks like it has already been covered before.


    https://goo.gl/Suz3T6
  • PJ_SneakersPJ_Sneakers Member Posts: 884 ■■■■■■□□□□
    I wonder how everyone's email got out. Did they send an email with a huge CC on it?
  • egb893egb893 Member Posts: 20 ■■■□□□□□□□
    Interesting, yesterday the link in the possible scam email forwarded to lumicybersecurity site. Tried it again right now and it's stays on the aws site but looks like the the lumicybersecurity site. The lumicybersecurity site is the site we took the exam on. I still don't think it's a scam email and I wouldn't put it in spam or block it.
Sign In or Register to comment.