%PDF-1.3 1 0 obj << /Type /Catalog /Outlines 2 0 R /Pages 3 0 R >> endobj 2 0 obj << /Type /Outlines /Count 0 >> endobj 3 0 obj << /Type /Pages /Kids [6 0 R 25 0 R ] /Count 2 /Resources << /ProcSet 4 0 R /Font << /F1 8 0 R /F2 9 0 R /F3 10 0 R /F4 11 0 R >> /XObject << /I1 24 0 R >> >> /MediaBox [0.000 0.000 612.000 792.000] >> endobj 4 0 obj [/PDF /Text /ImageC ] endobj 5 0 obj << /Creator (DOMPDF) /CreationDate (D:20250713135714+00'00') /ModDate (D:20250713135714+00'00') /Title (Report 07-2025) >> endobj 6 0 obj << /Type /Page /Parent 3 0 R /Annots [ 12 0 R 14 0 R 16 0 R 18 0 R 20 0 R 22 0 R ] /Contents 7 0 R >> endobj 7 0 obj << /Length 7931 >> stream 0.702 0.800 0.816 rg 34.016 34.016 543.969 723.969 re f 1.000 1.000 1.000 rg 45.266 80.351 521.469 666.383 re f 0.773 0.773 0.773 rg 0.773 0.773 0.773 RG 45.266 746.734 m 566.734 746.734 l 565.984 745.984 l 46.016 745.984 l f 566.734 746.734 m 566.734 80.351 l 565.984 80.351 l 565.984 745.984 l f 45.266 746.734 m 45.266 80.351 l 46.016 80.351 l 46.016 745.984 l f 0.200 0.200 0.200 rg BT 61.016 693.716 Td /F1 14.4 Tf [(SARS PHISHING SCAM FROM SUN EMAIL)] TJ ET 0.400 0.400 0.400 rg BT 61.016 664.909 Td /F2 9.0 Tf [(Posted on )] TJ ET BT 104.045 664.909 Td /F3 9.0 Tf [(January 01,1970)] TJ ET BT 173.588 664.909 Td /F2 9.0 Tf [( by )] TJ ET BT 188.096 664.909 Td /F3 9.0 Tf [(IT Communications)] TJ ET 0.153 0.153 0.153 rg BT 61.016 637.420 Td /F4 9.0 Tf [(If you receive an email with the subject SARS eFilings from any university email account, do not respond or click on the )] TJ ET BT 61.016 626.431 Td /F4 9.0 Tf [(link. This is not a legitimate email from SARS.)] TJ ET BT 61.016 606.442 Td /F4 9.0 Tf [(The suspicious email is being sent from compromised staff email accounts informing users that "An EMP Statement of )] TJ ET BT 61.016 595.453 Td /F4 9.0 Tf [(Account for the tax payer listed below has been issued by SARS" and you "need to log into the google doc with your )] TJ ET BT 61.016 584.464 Td /F4 9.0 Tf [(correct details to view the document". \(as shown in example below\):)] TJ ET BT 61.016 564.475 Td /F4 9.0 Tf [(It is important that you help us by spreading the word, informing us about suspicious mails and letting your colleagues and )] TJ ET BT 61.016 553.486 Td /F4 9.0 Tf [(friends know about the scams. You are our eyes and ears, and your input, information and questions are extremely )] TJ ET BT 61.016 542.497 Td /F4 9.0 Tf [(valuable.)] TJ ET BT 61.016 522.508 Td /F4 9.0 Tf [(When you click on links and provide your information on phishing emails, criminals will be able to gain access to your )] TJ ET BT 61.016 511.519 Td /F4 9.0 Tf [(personal information. If you clicked on the link of this phishing email, immediately go to the www.sun.ac.za/useradm )] TJ ET BT 61.016 500.530 Td /F4 9.0 Tf [(website and change the passwords on all your university accounts.)] TJ ET BT 61.016 480.541 Td /F4 9.0 Tf [(Remember that once the phishers lose control of one compromised account they might simply move over to another )] TJ ET BT 61.016 469.552 Td /F4 9.0 Tf [(account and they might also close the website they were using once it is blocked by us and would use another one that )] TJ ET BT 61.016 458.563 Td /F4 9.0 Tf [(looks and acts in the same way.Currently, the phishers are servers in Europe to launch their attacks.This is a common )] TJ ET BT 61.016 447.574 Td /F4 9.0 Tf [(tactic with a spear-phishing attack such as this.)] TJ ET BT 61.016 425.785 Td /F4 9.0 Tf [(To help us, please:)] TJ ET 0.153 0.153 0.153 RG 85.866 408.612 m 85.866 409.024 85.696 409.434 85.404 409.726 c 85.113 410.017 84.703 410.187 84.291 410.187 c 83.878 410.187 83.469 410.017 83.177 409.726 c 82.885 409.434 82.716 409.024 82.716 408.612 c 82.716 408.200 82.885 407.790 83.177 407.498 c 83.469 407.207 83.878 407.037 84.291 407.037 c 84.703 407.037 85.113 407.207 85.404 407.498 c 85.696 407.790 85.866 408.200 85.866 408.612 c f BT 91.016 405.796 Td /F4 9.0 Tf [(continue to watch out for mail like or similar to this and do NOT respond to it, click on links or provide your email )] TJ ET BT 91.016 394.807 Td /F4 9.0 Tf [(address username or password)] TJ ET 85.866 386.634 m 85.866 387.046 85.696 387.456 85.404 387.748 c 85.113 388.039 84.703 388.209 84.291 388.209 c 83.878 388.209 83.469 388.039 83.177 387.748 c 82.885 387.456 82.716 387.046 82.716 386.634 c 82.716 386.222 82.885 385.812 83.177 385.520 c 83.469 385.229 83.878 385.059 84.291 385.059 c 84.703 385.059 85.113 385.229 85.404 385.520 c 85.696 385.812 85.866 386.222 85.866 386.634 c f BT 91.016 383.818 Td /F4 9.0 Tf [(report the new phishing mail to the correct e-mail addresses of Information Technology Cyber Security using the )] TJ ET BT 91.016 372.829 Td /F4 9.0 Tf [(method added to the bottom of this post)] TJ ET 85.866 364.656 m 85.866 365.068 85.696 365.478 85.404 365.770 c 85.113 366.061 84.703 366.231 84.291 366.231 c 83.878 366.231 83.469 366.061 83.177 365.770 c 82.885 365.478 82.716 365.068 82.716 364.656 c 82.716 364.244 82.885 363.834 83.177 363.542 c 83.469 363.251 83.878 363.081 84.291 363.081 c 84.703 363.081 85.113 363.251 85.404 363.542 c 85.696 363.834 85.866 364.244 85.866 364.656 c f BT 91.016 361.840 Td /F4 9.0 Tf [(remember, just because a mail comes from a student or a personnel e-mail address and has university )] TJ ET BT 91.016 350.851 Td /F4 9.0 Tf [(branding does not mean in any way that it is legitimate)] TJ ET BT 61.016 330.862 Td /F4 9.0 Tf [(If you have received mail that looks like this please immediately report it to the Information Technology Security Team )] TJ ET BT 61.016 319.873 Td /F4 9.0 Tf [(using the following method: \(especially if it comes from a university address\))] TJ ET BT 78.360 299.900 Td /F4 9.0 Tf [(1.)] TJ ET BT 91.016 299.884 Td /F4 9.0 Tf [(Start up a new mail addressed to )] TJ ET 0.373 0.169 0.255 rg BT 225.080 299.884 Td /F4 9.0 Tf [(sysadm@sun.ac.za)] TJ ET 0.373 0.169 0.255 RG 0.18 w 0 J [ ] 0 d 225.080 298.733 m 303.740 298.733 l S 0.153 0.153 0.153 rg BT 303.740 299.884 Td /F4 9.0 Tf [( \(CC: )] TJ ET 0.373 0.169 0.255 rg BT 327.239 299.884 Td /F4 9.0 Tf [(help@sun.ac.za)] TJ ET 0.18 w 0 J [ ] 0 d 327.239 298.733 m 391.904 298.733 l S 0.153 0.153 0.153 rg BT 391.904 299.884 Td /F4 9.0 Tf [(\))] TJ ET BT 78.360 288.911 Td /F4 9.0 Tf [(2.)] TJ ET BT 91.016 288.895 Td /F4 9.0 Tf [(Use the Title SPAM \(without quotes\) in the Subject.)] TJ ET BT 78.360 277.922 Td /F4 9.0 Tf [(3.)] TJ ET BT 91.016 277.906 Td /F4 9.0 Tf [(With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail )] TJ ET BT 91.016 266.917 Td /F4 9.0 Tf [(Window. It will attach the mail as an enclosure and a small icon with a light yellow envelope will appear in the )] TJ ET BT 91.016 255.928 Td /F4 9.0 Tf [(attachments section of the New Mail.)] TJ ET BT 78.360 244.955 Td /F4 9.0 Tf [(4.)] TJ ET BT 91.016 244.939 Td /F4 9.0 Tf [(Send the mail.)] TJ ET BT 61.016 224.950 Td /F4 9.0 Tf [(IF YOU HAVE FALLEN FOR THE SCAM:)] TJ ET BT 61.016 204.961 Td /F4 9.0 Tf [(If you did click on the link of this phishing spam and unwittingly give the scammers your username, e-mail address and )] TJ ET BT 61.016 193.972 Td /F4 9.0 Tf [(password you should immediately go to )] TJ ET 0.373 0.169 0.255 rg BT 221.081 193.972 Td /F4 9.0 Tf [(http://www.sun.ac.za/useradm)] TJ ET 0.18 w 0 J [ ] 0 d 221.081 192.821 m 341.627 192.821 l S 0.153 0.153 0.153 rg BT 341.627 193.972 Td /F4 9.0 Tf [( and change the passwords on ALL your university )] TJ ET BT 61.016 182.983 Td /F4 9.0 Tf [(accounts \(making sure the new password is completely different, and is a strong password that will not be easily )] TJ ET BT 61.016 171.994 Td /F4 9.0 Tf [(guessed.\) as well as changing the passwords on your social media and private e-mail accounts \(especially if you use the )] TJ ET BT 61.016 161.005 Td /F4 9.0 Tf [(same passwords on these accounts.\))] TJ ET BT 61.016 141.016 Td /F4 9.0 Tf [(For more information on reporting and combating phishing and spam:)] TJ ET 0.373 0.169 0.255 rg BT 339.638 141.016 Td /F4 9.0 Tf [(http://blogs.sun.ac.za/it/en/2017/11/reporting-spam-)] TJ ET 0.18 w 0 J [ ] 0 d 339.638 139.865 m 545.243 139.865 l S BT 61.016 130.027 Td /F4 9.0 Tf [(malware-and-phishing/)] TJ ET 0.18 w 0 J [ ] 0 d 61.016 128.876 m 152.042 128.876 l S 0.153 0.153 0.153 rg BT 402.934 110.038 Td /F4 9.0 Tf [([Information supplied by David Wiles])] TJ ET BT 61.016 90.049 Td /F4 9.0 Tf [()] TJ ET q 225.000 0 0 145.500 61.016 427.766 cm /I1 Do Q endstream endobj 8 0 obj << /Type /Font /Subtype /Type1 /Name /F1 /BaseFont /Helvetica-Bold /Encoding /WinAnsiEncoding >> endobj 9 0 obj << /Type /Font /Subtype /Type1 /Name /F2 /BaseFont /Helvetica-Oblique /Encoding /WinAnsiEncoding >> endobj 10 0 obj << /Type /Font /Subtype /Type1 /Name /F3 /BaseFont /Helvetica-BoldOblique /Encoding /WinAnsiEncoding >> endobj 11 0 obj << /Type /Font /Subtype /Type1 /Name /F4 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >> endobj 12 0 obj << /Type /Annot /Subtype /Link /A 13 0 R /Border [0 0 0] /H /I /Rect [ 61.0157 427.7659 286.0157 573.2659 ] >> endobj 13 0 obj << /Type /Action /S /URI /URI (http://blogs.sun.ac.za/it/files/2018/08/burden.jpg) >> endobj 14 0 obj << /Type /Annot /Subtype /Link /A 15 0 R /Border [0 0 0] /H /I /Rect [ 225.0797 299.0512 303.7397 308.2087 ] >> endobj 15 0 obj << /Type /Action /S /URI /URI (mailto:sysadm@sun.ac.za) >> endobj 16 0 obj << /Type /Annot /Subtype /Link /A 17 0 R /Border [0 0 0] /H /I /Rect [ 327.2387 299.0512 391.9037 308.2087 ] >> endobj 17 0 obj << /Type /Action /S /URI /URI (mailto:help@sun.ac.za) >> endobj 18 0 obj << /Type /Annot /Subtype /Link /A 19 0 R /Border [0 0 0] /H /I /Rect [ 221.0807 193.1392 341.6267 202.2967 ] >> endobj 19 0 obj << /Type /Action /S /URI /URI (http://www.sun.ac.za/useradm) >> endobj 20 0 obj << /Type /Annot /Subtype /Link /A 21 0 R /Border [0 0 0] /H /I /Rect [ 339.6377 140.1832 545.2427 149.3407 ] >> endobj 21 0 obj << /Type /Action /S /URI /URI (http://blogs.sun.ac.za/it/en/2017/11/reporting-spam-malware-and-phishing/) >> endobj 22 0 obj << /Type /Annot /Subtype /Link /A 23 0 R /Border [0 0 0] /H /I /Rect [ 61.0157 129.1942 152.0417 138.3517 ] >> endobj 23 0 obj << /Type /Action /S /URI /URI (http://blogs.sun.ac.za/it/en/2017/11/reporting-spam-malware-and-phishing/) >> endobj 24 0 obj << /Type /XObject /Subtype /Image /Width 300 /Height 194 /ColorSpace /DeviceRGB /Filter /DCTDecode /BitsPerComponent 8 /Length 10899>> stream JFIF;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82 C    !'"#%%%),($+!$%$C   $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$," }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ?K^tAm챷̹dwӿ% O<km:+YG'1RYjpYlPAS(QF(1F(1@b(b (QEQE% O𿄭 27Opr9Kڕ>st+Y,tKyWl p{֕72(ʿfYDj$+_'mYz"0W ]k3vr5մ GQrH Vf<09dGm>e l% @9}Əg=ᴙLs{\x?IJFb+Tbp}Ǡ8MFI2 ۙUQ~i qQv"xlYBHdv nr{ }hKl6bg/'j)옷Xϻ8}jZʶ6O"ó`0n˵Z{,Wlp9݌ӚBvdW=,&XXmj&8 ۛ$|zS vP>b=:`=k7^-[pѤɸg88݃Oo&vq:+x\A*Epf91qĭ'}fl(m vۥtTW:.P,c+1 1Sj;EʖH{h:\4PSzd0Oüw>%Y\<|7NI<~Ess>&2ٶqm'`9hhwz vpP!9sy J()i{, *违UdXgv ǀ>S󬮡;w}8|L|(_Ώ:8AvTzE qks:H<YR,{Ev ] *?vܰiOfdծ?ypLc=ԔEx L,7; m+Bvn ķ[p"Yʁ9Ucg*N 5gpɍѥWpnNcG9,G1RM %"GFI]>l{8 +_  8_6; +iwysZmZk]Zج,dP!G>+grYbYH m(ϰ,&69!+"[aJP.#XD:6ً1Ʈ~4xK;av.@EP7uY * F@]z2u,<6l^Vf2`s7E5%;/dy7.fT=FOzJ;p}n[~*V֊,g{wUw187F^>`@8#EkEkekeq煀pXBӯR 9Lf8r0O^㏡>GCNMr,1h`8MhA*]ۼDҬ -#߅ys@ 0"VdUl"{Luietv#Q)s(|V/| j\[;M,+1fRH*|E76svP0;7U-sCNԾ!zF%僙|P dtLJaɎdf`36 '֦qwm$f:%0-*מo|mXY ";l \cOQ#2POݷvr-4H'yU'kg͟-Hs팚_K&i$mBYKݎ?4{-R\$?QxR/|}Z_4Ic?_0F ̓€,Eytb*0OU(])E(0* 8N:՘mHXS"Iǔ[#$?Z>%l?l #dq?I䙆~m< rG<^,ԷG.[6?tq wZEy乑cB0^Prq:*5[8yur&DȪ@#{hNqm5/#jwpۂJ}ӍeFj6km% I ܃@0Xt˱gvE$wv~wPhv:4]R~،~Ri8=]v<{&iJD `I'$ƭ  )$O;|)ݓ<ߧ}foZEևj:I &aIJ: ⇖╯Me嫲mXsǹ\M}cu!Ӯ v6b[0vA׌1C:U~&hv4+}oB۲ \=)K.ħof9(2xZ($y/ ٭9=H?K'mഴkRS Ys1}i9((—=R(d{uVSЂQwJM͌2T$d#w\5Rg8!3\DK[H5Oi$p*8۴HI<j& :ˀJ.H8P=QE=2,*ț%C_Ns\|Ege%[ sq$q3*0VaT7zXVǎodQP˧n# P=ejJ6Z[ۛo>+D$*oN<)mI [}~cuH.L:vւk&FQP ~Rdj;B10ws ͐6sӭhGH(9Or~7!KIZ if7ܥ+!#?!یcO}%4*ۼv奚71F1ԑǠ9sJXKEΪA xt,#FIdb?kOovI,Or!U9lHԉ[Ǻ\0,6+QZ6wvXu";푃h `1G ㏧ȼ)Bţ-$}E6:4K XREEm/s3靼29 x^ԅ0" @wg~rAV20 OhqTӡP^22<ퟻ>.N܃8>sע1z6n `;Wo la ['.WfO98ZPd. m>Hv?'''MD<#.Ռl &v醎2AclQ@wѮiyd9s$ѮOh1v2sZ(;B1nl s1z<B%ҭULmۿcckfO hѼo bQ]bʟvO}kШ?͋Gg:2I0luk7 ~G̪x#vT9"QEpTұi k¢GW $[x >py<3G={Ƈ9E91F%c$v@ (A6.s~T(6/\ (*JZ(/DQ8yk9Zu-r~Q^:Wq:1EPEPEPEPEPEPEPEPEPEPEPM(qEYWW++cU4G-@ 0qGdڍO3"p d`#aǽKvL>z ed=iPI 7V3ol^Y3[(w .7 s%~K$-Bc#PEwUs.YN6>n9j& 4ou4v؇@_8vGRu˰&G-IF׷t.Bwc)Qk06}N}(FʖU(|#o\tFNߟqנ Z+%P9lC cKBc@01'P:Em\ ԋy~b$|p_(BڙNcO{E6* ͸Ѣ%/Ʃb]03s^"4h϶lʿa -8T.V[Px?ZТUT:c! %oG[I~FMO9?ƨkmfZIe*Ma?x9ztI(Gv&ΆzٍvS+ٍpr0yn}\(;/ }G=vfb;/QY7/zỌ=_"AN2Š2(@fE(((`36zHWvN[۞S? )U-0Q#F[c I$zN}zV%&GOvjB#̅0?5zT  c k&&Z@'nEdZʨ-'8ך62<̃'1޴h UxXJ$pS?);ס<ןi@G,nR  縭(5O)y76{5V1p5Ee+T2%Uӌn$N6XQТ(cT#ߛبkJI#?'[PtHcPLo\4^V9| ʨŸ::I`A9OLh2jRVD_>j' 1޴(kbUHF>%`+(( O]袪_& (((((((((((((((((( endstream endobj 25 0 obj << /Type /Page /Parent 3 0 R /Contents 26 0 R >> endobj 26 0 obj << /Length 627 >> stream 0.153 0.153 0.153 rg 0.373 0.169 0.255 RG 0.18 w 0 J [ ] 0 d 0.702 0.800 0.816 rg 34.016 34.016 543.969 723.969 re f 1.000 1.000 1.000 rg 45.266 719.245 521.469 38.739 re f 0.773 0.773 0.773 rg 0.773 0.773 0.773 RG 45.266 719.245 m 566.734 719.245 l 565.984 719.995 l 46.016 719.995 l f 566.734 757.984 m 566.734 719.245 l 565.984 719.995 l 565.984 757.984 l f 45.266 757.984 m 45.266 719.245 l 46.016 719.995 l 46.016 757.984 l f 61.016 734.995 m 550.984 734.995 l 550.984 735.745 l 61.016 735.745 l f 0.400 0.400 0.400 rg BT 61.016 749.193 Td /F2 9.0 Tf [(Posted in:E-mail,Phishing,Security | | With 0 comments)] TJ ET endstream endobj xref 0 27 0000000000 65535 f 0000000008 00000 n 0000000073 00000 n 0000000119 00000 n 0000000339 00000 n 0000000376 00000 n 0000000514 00000 n 0000000631 00000 n 0000008614 00000 n 0000008726 00000 n 0000008841 00000 n 0000008961 00000 n 0000009069 00000 n 0000009196 00000 n 0000009298 00000 n 0000009426 00000 n 0000009501 00000 n 0000009629 00000 n 0000009702 00000 n 0000009830 00000 n 0000009910 00000 n 0000010038 00000 n 0000010163 00000 n 0000010290 00000 n 0000010415 00000 n 0000021483 00000 n 0000021548 00000 n trailer << /Size 27 /Root 1 0 R /Info 5 0 R >> startxref 22227 %%EOF E-mail « Informasietegnologie
Language:
SEARCH

  • Recent Posts

  • Categories

  • Archives

E-mail

« Older Entries
Newer Entries »

Phishing Scam with subject: “IT Helpdesk! Treat Very Urgently!”

Wednesday, April 25th, 2018

There is a rather pesky phishing e-mail making its rounds at the moment that you need to watch out for.

The Subject is “IT HelpDesk! Treat Very Urgently!”

The subject alone with its exclamation marks and every word capitalised should show that it is a phishing mail.

Below is an example of the mail:

Please do not respond or click on the links. Report it to the IT CyberSecurity reporting addresses.

Here’s how to report any phishing or spam mail:

Send the spam/phishing mail to help@sun.ac.za and sysadm@sun.ac.za.

Attach the phishing or suspicious mail on to the message if possible.
1. Start up a new mail addressed to sysadm@sun.ac.za (CC: help@sun.ac.za)
2. Use the Title “SPAM” (without quotes) in the Subject.
3. With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail Window. It will attach the mail as an enclosure and a small icon with a light yellow envelope will appear in the attachments section of the New Mail.
4. Send the mail.

Email

Tags:
Posted in E-mail, Security | Comments Off on Phishing Scam with subject: “IT Helpdesk! Treat Very Urgently!”

Phishing e-mail with deceptive subject “IT ADMIN”

Tuesday, April 10th, 2018

Several observant colleagues and some students have reported a number of phishing emails being sent (usually in pairs) from a university account in the United Kingdom. The subject is “IT ADMIN” with no salutation or any other information other than “You have a pending message click here to read”.

With some students still on their autumn break and many colleagues only returning this week from the short school holiday, mailboxes have filled up full, voicemails and Skype 4 Business voice messages might have been left and some might be fooled into thinking that a message from “IT ADMIN” *might* be important.

This is a common tactic used by phishing scammers to attempt to con their victims into giving their usernames and passwords.

Many phishing emails use short and cryptic messages to instil a sense of urgency to scare users into doing the attackers’ bidding. In this case, a short mail about a mysterious “pending message” requires the victims to click on a link in order to retrieve the message. In actuality, the link leads to a fake login page designed to collect the user’s login credentials and deliver them to the attackers.

You should always inspect all URLs carefully to see if they redirect to an unknown website – this scam links to weebly.com. Also look out for generic salutations, grammar mistakes, and spelling errors scattered throughout the email. There are several in this mail.

It is no coincidence that a compromised UK university email address has been used. Large institutions like universities, with large numbers of students and personnel, are always a challenge to protect and are choice targets for phishing attacks.

In the same way, some Stellenbosch University students and personnel are fooled by the scam and give the scammers their passwords and login details by filling them in on the fake login page. The original email account is discarded by the scammers and compromised Stellenbosch University accounts might be used. This has happened several times before.

So, do not be surprised if later this week there is a fresh breakout of these “pending message” mails from “IT ADMIN” but this time coming from Stellenbosch University student or personnel accounts. It is very important to report this to the IT Cyber Security team.

If you have received mail that looks like this, please immediately report it by sending the spam/phishing mail to help@sun.ac.za
and sysadm@sun.ac.za. 

Attach the phishing or suspicious mail on to the message if possible.
1. Start up a new mail addressed to sysadm@sun.ac.za (CC: help@sun.ac.za)
2. Use the Title “SPAM” (without quotes) in the Subject.
3. With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail Window. It will attach the mail as an enclosure and a small icon with a light yellow envelope will appear in the attachments section of the New Mail.
4. Send the mail.

[Article by David Wiles]

Email

Tags:
Posted in E-mail, phishing | Comments Off on Phishing e-mail with deceptive subject “IT ADMIN”

Forgot to reactivate?

Tuesday, April 3rd, 2018

To have access to internet, email and any other network service, you need to reactivate your username annually. If you haven’t reactivated for 2018, your access will have expired on 4 April. What do you do now?

  1. You will not be able to access the network from your devices. In order to reactivate, use a colleague’s PC or laptop.
  2. Browse to the following address: www.sun.ac.za/useradm.
  3. You will see three options:
    Sign on 
    Forgot password
    Reactivate expired username

    Select Reactivate expired username.

4. You will be asked to sign in with your username and ID number or Passport number. See example below.

5. After signing in, you will see a list of options for your username, as well as the appropriate cost points options. 

6. Select the usernames you want to activate and fill in the correct cost point. This is very important. Rather make sure which cost point you should use from your department’s financial officer. If it’s incorrect it will result in a delay of your activation. 

7. Your request for activation will be forwarded to your cost centre manager. 

8. As soon as they approve it, you will have access to the SU network again.

 

 

Email

Tags: ,
Posted in E-mail, Internet | Comments Off on Forgot to reactivate?

“Cryptocurrency” scam email

Wednesday, March 28th, 2018

Please be aware of a  scam making the rounds since yesterday.

It is a “Crypto-currency” (bitcoin) scam that comes in the form of an e-mail from an unknown sender (currently an address from name@dacfinance.online). It will look like this:

 

 

Hi, how are you?
I hope you are okay

 I’ve been trying to reach you for the past couple of days.

Something MAJOR is happening in the trading world and I want you to know about it.

>> Check this with your email somebody@sun.ac.za

 Are you ready for that kind of spending power?

Many people already started to trade cryptocurrencies, BitCoin and LiteCoin.

Join now to our Group!

 To your success,
Some Name
 DAC Finance

cryptocurrency.website address

 

 

This is a sneaky attempt to defraud users seeking an opportunity to invest in Bitcoins (crypto-currency). The website you are taken to is filled with fake testimonials, inflated bank account numbers, exaggerated claims of easy money and various other lies and fabrications. The software that you would be asked to install is fake and will compromise security on your computer and be used to send spam. Furthermore, victims will have to pay anything up to $250 to join the “investment” scheme and the only thing that will happen is that you will be $250 poorer. Here is an example of the website page:

Do not respond to this mail or be tempted to join this scheme. The fact that university e-mail addresses reused and the claims look legitimate should rather be a warning.

As always if you have received mail that looks like this, please immediately report it to the Information Technology Security Team using the following method:

Send the spam/phishing mail to help@sun.ac.za and sysadm@sun.ac.za.
Attach the phishing or suspicious mail on to the message if possible.
1. Start up a new mail addressed to sysadm@sun.ac.za (CC: help@sun.ac.za)
2. Use the Title “SPAM” (without quotes) in the Subject.
3. With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail Window. It will attach the mail as an enclosure and a small icon with a light yellow envelope will appear in the attachments section of the New Mail.
4. Send the mail.

[Article by David Wiles]

Email

Tags: , ,
Posted in E-mail, Security | Comments Off on “Cryptocurrency” scam email

Phishing email with subject: “ DO NOT IGNORE THE WARNING”

Thursday, March 15th, 2018

Several staff are receiving a “threatening” e-mail with the subject “<your email address> DO NOT IGNORE THE WARNING”

Your e-mail address will be inserted at the begining of the message, and then proceeds to inform you about your account being used for “spam activities” and that it will be blacklisted and permanently suspended.

Here is an example of the mail (with all the dangerous stuff removed)

If you are fooled into clicking on the link, you will be taken to a website (based in Zimbabwe) and your e-mail address will be automatically inserted in the field, and you will be asked to type in your password, and then the scammers will have gained access to your network account!

This is a typical tactic employed by phishers targeting university e-mail accounts. They use your contact details and intimidating language to cause you to panic and “click on the link they provide.

When spotting phishing scams remember:

  1. Don’t trust the display name.
  2. Look but don’t click.
  3. Check for spelling mistakes.
  4. Analyse the salutation.
  5. Don’t give up personal information – ever.
  6. Beware of urgent or threatening language in the subject line.
  7. Review the signature (remember the university’s own centennial celebration and “water-wise” branding is being used in *some* external phishing attacks)
  8. Don’t click on attachments.
  9. Don’t trust the header from an email address.
  10. Don’t believe everything you see.

Phishers are extremely good at what they do. Just because an email has convincing brand logos, language, and a seemingly valid email address, does not mean that it’s legitimate. Be sceptical when it comes to your email messages—if it looks even remotely suspicious, don’t open it.

If you have received mail that looks like this, please immediately report it to the Information Technology Security Team using the following method:

Send the spam/phishing mail to the following addresses: help@sun.ac.za and sysadm@sun.ac.za. 

Attach the phishing or suspicious mail on to the message if possible.  

  1. Start up a new mail addressed to sysadm@sun.ac.za (CC: help@sun.ac.za)
  2. Use the Title “SPAM” (without quotes) in the Subject.
  3. With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail Window. It will attach the mail as an enclosure and a small icon with a light yellow envelope will appear in the attachments section of the New Mail.
  4. Send the mail.

[Article by David Wiles]

Email

Posted in E-mail, phishing, Security | Comments Off on Phishing email with subject: “ DO NOT IGNORE THE WARNING”

« Older Entries
Newer Entries »
 

© 2013-2025 Disclaimer: The views and opinions expressed in this page are strictly those of the page author(s) and content contributor(s). The contents of this page have not been reviewed or approved by Stellenbosch University.