[CCoE Notice] Subject: Unusual Sign in Attempt

[Luong, Kiet A]

Good morning,

Many of us received this email (below) this past week, and wondered if it's legitimate.  Hopefully by now, we've all become better at analyzing suspicious emails.  These are the facts I found in this email:
-The sender (lkelly at mris) is someone unknown to us.  How you determine the "true" sender is to hover the cursor over the email address to reveal the actual email address.  The label "AccessUH" in front of the email address should NEVER be a consideration when assessing legitimacy of the email.  This label can be created by anyone, including hackers who aim their attacks at UH employees by using UH known words.
-The "To:" address may or may not be an actual email address, but it is irrelevant to us individually.  Additionally, the address "secure at uh.edu" and subject "Unusual Sign in Attempt" are meant to create a sense of importance, fear or panic, and hopes for us act without further consideration.
-In the event one of your accounts experience unusual login attempts, UIT security will contact us, then we will contact you.  It is highly unlikely UIT security will contact you directly and ask you to do something to correct an issue with your accounts without including us.
-You can always determine the web address of any web link by hovering the cursor over the link without clicking on it.  In this case, "Preview details" points to  "http:secure-my-uh-edu.jimdo.com".  The emphasis is on the xxx.com, which shows that this website is nowhere close to being a UH web link.  Besides, you can never solve an UH account problem by clicking on a link, much less a link that takes you to a non-UH website.
-Finally, there are no official UH signatures, or names who you can contact to verify this email with.

Hope this helps you to identify legitimacy of this and other future suspicious emails.

Kiet Luong
Director of Engineering Computing
College Information Security Officer
Cullen College of Engineering
University of Houston
Email: KietL at uh.edu
Voice: 713.743.9974

From: AccessUH <lkelly at mris.com<mailto:lkelly at mris.com>>  (or UH Security [mailto:lkelly at mris.com])
Date: November 27, 2015 at 6:09:09 AM CST
To: "secure at uh.edu<mailto:secure at uh.edu>" <secure at uh.edu<mailto:secure at uh.edu>>
Subject: Unusual Sign in Attempt



PREVIEW DETAILS<http://secure-my-uh-edu.jimdo.com/>



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://Bug.EGR.UH.EDU/pipermail/engi-dist/attachments/20151130/0fd07862/attachment.html