"Unusual IP activity" Phish


LSU Personnel started receiving a phishing e-mail on February 15th, 2017 related to e-mail account being accessed from unusual IP addresses. 

Subject of the Phishing e-mail - Unusual IP activity

Sender Name - External User

Sender e-mail address - External Address (@savba.sk)

The content of the message states the following (Links and other descriptors have been removed for security purposes):

Webmail account
Unusual IP activity
We detected Someone just tried to sign  in into your web mail account from other IP address.Please confirm your identity today or your account will be disabled due to concerns we have for the safety and integrity of your web mail..
To Confirm your identity,We recommend that you  go to
Verify Now
To opt out or change where you receive security notifications, click here.
The Web mail  account team

The URL provided in the e-mail does not belong to LSU and directs the user to a third-party site. 

NOTE: ALWAYS verify the URL provided in the e-mail and please note that LSU will not ask you to verify your accounts in such a fashion.