+ Reply to Thread
Results 1 to 17 of 17
  1. Senior Member danny069's Avatar
    Join Date
    Nov 2012
    Location
    NYC
    Posts
    999

    Certifications
    A+, Security+, ACMT, CASP, CEH, CCNA R&S, A.S. & B.S. Cyber Security Systems/Digital Forensics, M.S. Cyber Security
    #1

    Default Cisco Cyber Scam E-mail

    Beware of this email guys and girls, I got this today, it's a scam, especially since all of the excitement of the cisco cyber scholarship going around, I removed the full links so no one clicks on them:

    "Lumicybersecurity Support <noreply@lumicybersecurity.com>
    3:04 PM (32 minutes ago)


    to me
    Hi First Name Last Name,


    A new account has been created for you at 'Cisco Cyber Security'
    and you have been issued with a new temporary password.


    Your current login information is now:
    username: firstname.lastname@gmail.com
    password: +w5s$Ia:;3
    (you will have to change your password
    when you login for the first time)


    To start using 'Cisco Cyber Security', login at
    http://ec2-54-149-220-207.?.?


    In most mail programs, this should appear as a blue link
    which you can just click on. If that doesn't work,
    then cut and paste the address into the address
    line at the top of your web browser window.


    Cheers from the 'Cisco Cyber Security' administrator,


    Lumicybersecurity Support
    support at t2000inc.?
    http://ccs-totara-1756017806.?.?"
    I am a Jack of all trades, Master of None
    Reply With Quote Quote  

  2. SS -->
  3. Senior Member E Double U's Avatar
    Join Date
    Apr 2014
    Location
    The Netherlands
    Posts
    1,159

    Certifications
    CISSP, CISM, GCIA, GCIH, C|EH, and more.
    #2
    Now you tell me.
    "You tried your best and you failed miserably. The lesson is, never try." - Homer Simpson
    Reply With Quote Quote  

  4. They are watching you NetworkNewb's Avatar
    Join Date
    Feb 2015
    Location
    Off the grid
    Posts
    2,624

    Certifications
    A+/Net+/Sec+, CCENT, CCNA:Sec, CCSK, GCIH
    #3
    I thought it was little weird that Cisco would ask me for my PIN number... dammit
    Reply With Quote Quote  

  5. Senior Member cyberguypr's Avatar
    Join Date
    May 2007
    Location
    Chicago, IL
    Posts
    5,821

    Certifications
    GCFE, GCED, GCIH, CISSP, CCSP, and others that should never be mentioned
    #4
    The only thing strange here is that they are using the exact same random password I use for all my bank accounts. What a coincidence!
    Reply With Quote Quote  

  6. Senior Member Cyberscum's Avatar
    Join Date
    Oct 2014
    Location
    25.0000° N, 71.0000° W
    Posts
    738

    Certifications
    Certified Coccyx Inspector
    #5
    Dammit danny69.

    Gonna have to go back to using my Nigerian money transfer email again.

    Thanks for ruining the fun
    Reply With Quote Quote  

  7. Junior Member Registered Member
    Join Date
    Aug 2016
    Posts
    4
    #6
    wait, so is the scholarship program real or not? this got me lost, i dont even know the password i used when I changed my cisco password.
    Reply With Quote Quote  

  8. Senior Member danny069's Avatar
    Join Date
    Nov 2012
    Location
    NYC
    Posts
    999

    Certifications
    A+, Security+, ACMT, CASP, CEH, CCNA R&S, A.S. & B.S. Cyber Security Systems/Digital Forensics, M.S. Cyber Security
    #7
    The program is real, this e-mail is not, just making people aware.
    I am a Jack of all trades, Master of None
    Reply With Quote Quote  

  9. Junior Member
    Join Date
    Sep 2009
    Location
    Texas
    Posts
    20

    Certifications
    A.A.S Information Security & Assurance, CCNA-R&S, CCNA-Sec, CCNA-Voice, MCTS:70-680, Sec+, A+
    #8
    It's not a scam email, just an email sent in error. I received the email posted here and just received a follow up email.

    Dear Scholarship Applicants,

    We’ve been alerted that you may have received an email with new login credentials to the Cisco Cybersecurity site, please disregard this email. If you have completed your prequalification assessment your login credentials were removed today and this email was generated in error. You will hear from Cisco within the next couple weeks with an update on the scholarship status. All users who receive the scholarship will receive new credentials at a later date.

    Please note this email is not an indicator of scholarship status.

    Thank you,

    Sabrina Moore
    Reply With Quote Quote  

  10. Member liz4rd's Avatar
    Join Date
    Sep 2015
    Location
    UK
    Posts
    39

    Certifications
    CCNA R&S, Security+, Network+
    #9
    Not a scam. Was just sent out in error.

    The email is actually from Cisco
    Reply With Quote Quote  

  11. Senior Member danny069's Avatar
    Join Date
    Nov 2012
    Location
    NYC
    Posts
    999

    Certifications
    A+, Security+, ACMT, CASP, CEH, CCNA R&S, A.S. & B.S. Cyber Security Systems/Digital Forensics, M.S. Cyber Security
    #10
    It is a scam email guys. They sent a "follow up" email to set your mind at ease to make it seem like it is legit. I received a real email from Cisco today saying they have my assessment, cmon Sabrina Moore? really?
    I am a Jack of all trades, Master of None
    Reply With Quote Quote  

  12. Senior Member danny069's Avatar
    Join Date
    Nov 2012
    Location
    NYC
    Posts
    999

    Certifications
    A+, Security+, ACMT, CASP, CEH, CCNA R&S, A.S. & B.S. Cyber Security Systems/Digital Forensics, M.S. Cyber Security
    #11
    Let's examine the header:


    Delivered-To: danny.xxx@gmail.comReceived: by 10.79.118.12 with SMTP id r12csp1170996ivc; Mon, 12 Sep 2016 12:04:21 -0700 (PDT)X-Received: by 10.66.155.129 with SMTP id vw1mr35678718pab.148.1473707061803; Mon, 12 Sep 2016 12:04:21 -0700 (PDT)Return-Path: <support@t2000inc.zendesk.com>Received: from ip-172-31-11-18.us-west-2.compute.internal (ec2-54-149-220-207.us-west-2.compute.amazonaws.com. [54.149.220.207]) by mx.google.com with ESMTP id 19si22861244pft.165.2016.09.12.12.04.21 for <danny.xxx@gmail.com>; Mon, 12 Sep 2016 12:04:21 -0700 (PDT)Received-SPF: softfail (google.com: domain of transitioning [email]support@t2000inc.zendesk.com does not designate 54.149.220.207 as permitted sender) client-ip=54.149.220.207;Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning [email]support@t2000inc.zendesk.com does not designate 54.149.220.207 as permitted sender) smtp.mailfrom=support@t2000inc.zendesk.comReceived : by ip-172-31-11-18.us-west-2.compute.internal (Postfix, from userid 33) id F3C1527B64; Mon, 12 Sep 2016 19:04:26 +0000 (UTC)To: "Danny069 at Techexams" <danny.xxx@gmail.com>Subject: Cisco Cyber Security: New user accountX-PHP-Originating-Script: 33:class.phpmailer.phpDate: Mon, 12 Sep 2016 15:04:26 -0400From: "Lumicybersecurity Support" <noreply@lumicybersecurity.com>Reply-To: "Lumicybersecurity Support" <support@t2000inc.zendesk.com>Message-ID: <a23a36c6ec9221e152e9e7fa90103680@ip-172-31-2-34>X-Priority: 3X-Mailer: PHPMailer Totara 2015051107 (https://github.com/PHPMailer/PHPMailer/)MIME-Version: 1.0Content-Type: text/plain; charset=UTF-8Content-Transfer-Encoding: 8bitThe source IP address is from Amazon Web Services, from Portland Oregon. It just does not seem legit to me. I know I would not login again when I already have.
    Last edited by danny069; 09-13-2016 at 04:27 PM.
    I am a Jack of all trades, Master of None
    Reply With Quote Quote  

  13. They are watching you NetworkNewb's Avatar
    Join Date
    Feb 2015
    Location
    Off the grid
    Posts
    2,624

    Certifications
    A+/Net+/Sec+, CCENT, CCNA:Sec, CCSK, GCIH
    #12
    Quote Originally Posted by danny069 View Post
    It is a scam email guys. They sent a "follow up" email to set your mind at ease to make it seem like it is legit. I received a real email from Cisco today saying they have my assessment, cmon Sabrina Moore? really?
    Are you saying Sabrina Moore isn't real? From this reddit thread it sounds like Sabrina has responded to individual emails they have sent in.

    https://www.reddit.com/r/ccna/commen...am_assessment/
    Reply With Quote Quote  

  14. Senior Member danny069's Avatar
    Join Date
    Nov 2012
    Location
    NYC
    Posts
    999

    Certifications
    A+, Security+, ACMT, CASP, CEH, CCNA R&S, A.S. & B.S. Cyber Security Systems/Digital Forensics, M.S. Cyber Security
    #13
    I compared the headers of the legit cisco email and they do not match up. No where in this header do I see cisco.com, the legit e-mail does. A lot of people will get their usernames and passwords stolen.
    I am a Jack of all trades, Master of None
    Reply With Quote Quote  

  15. Senior Member chrisone's Avatar
    Join Date
    Nov 2009
    Location
    Los Angeles
    Posts
    1,569

    Certifications
    SpecterOps: Powershell Adversary Tactics, SilentBreakSecurity - DarkSideOps, CISSP, CCDP, CCNP R/S, CCNP Security (Secure, FW) , C|EH , PA ACE
    #14
    So you mean to tell me I didn't have to send that $1000 to the prince of Nigeria?
    2017 Goals: Dark Side OPS: Custom Pentesting (complete), SpecterOps: PowerShell Adversary Tactics (completed), eCPPT (2nd attempt), LFCS (2nd attempt), OSCP (Ah next year...)
    Reply With Quote Quote  

  16. Senior Member Cyberscum's Avatar
    Join Date
    Oct 2014
    Location
    25.0000° N, 71.0000° W
    Posts
    738

    Certifications
    Certified Coccyx Inspector
    #15
    This is interesting. I just got one too.

    It looks like it has already been covered before.


    https://goo.gl/Suz3T6
    Reply With Quote Quote  

  17. The ceiling is glass. PJ_Sneakers's Avatar
    Join Date
    Nov 2014
    Location
    169.254.0.1
    Posts
    768

    Certifications
    AccessData, Cellebrite, CompTIA, EC-Council, IACRB, (ISC)˛, Microsoft, MSAB
    #16
    I wonder how everyone's email got out. Did they send an email with a huge CC on it?
    Reply With Quote Quote  

  18. Junior Member
    Join Date
    Sep 2009
    Location
    Texas
    Posts
    20

    Certifications
    A.A.S Information Security & Assurance, CCNA-R&S, CCNA-Sec, CCNA-Voice, MCTS:70-680, Sec+, A+
    #17
    Interesting, yesterday the link in the possible scam email forwarded to lumicybersecurity site. Tried it again right now and it's stays on the aws site but looks like the the lumicybersecurity site. The lumicybersecurity site is the site we took the exam on. I still don't think it's a scam email and I wouldn't put it in spam or block it.
    Reply With Quote Quote  

+ Reply to Thread

Social Networking & Bookmarks