Ohio State regularly runs phishing training exercises to the university community. By clicking the link that brought you to this page, you succumbed to a university phishing simulation. Read on to learn how to spot phishing messages and protect yourself and the university from malicious attacks.
Spotting the Phish
You received this email:
When you click from this email, you are taken to a generic login page:
Sender Addresses: The sender address, usufyusuf587773@gov-services.com, is not known to you, and this seems like a mass marketing effort. However, the domain address is generic and doesn't match the entity shown in the body of the email. You should remain skeptical of addresses that some from outside Ohio State. The domain (everything after the @ symbol) is the first indication that this might be a phishing attack.
Suspicious Language: A congratulations from a governing body that doesn't exist, the Ministry of Education, should have been a red flag. If you receive promotional offers from merchants you don't normally engage with, you should treat their outreach as suspicious.
Review the URL of web page before engaging with it: When you clicked from the email, a website was loaded with a URL of https://grantapproval gov-serices.com which is not a legitimate site. Attempt to confirm the legitimacy of a site before you enter login credentials or personal information like name, email address or phone number.
Branding: the login page is to a service unknown to you, ScreenConnect. Be leery of anyone asking for your credentials outside of out normal process.
Report Phishing Attempts
If you ever suspect an email to be a phishing attempt, please report it immediately by clicking the "Report Suspicious" button in the warning banner which appears at the top of that external email.