People keep reporting emails that say something like:

Dear network user,
Your account has violated a quota and will be turned off.
To avoid this, email your login name and password to
somebody@somewhere.com.

Signed, wou.edu administrator

To us geek types, this is obviously a scam. I just keep getting reminded that other people don’t instantly spot this for what it is, even when it tells them to send their info to a non-WOU address. It can be even harder to spot when the From: address on the email is something like admin@wou.edu, or the message tells you to go to a link that looks like it’s on our website but actually goes elsewhere.

So really what we need are some general rules of thumb. The first and most obvious is never, ever, ever, EVER put your password into an email message. Never. And did I mention never? Of course this means we UCS folks should never ask someone for their password except in person — we really don’t even want to get users in the habit of saying their password over the phone.

Another rule of thumb would be never trust emails from generic addresses. When we send messages out, they’ll have a specific name on them, not just “admin@wou.edu” or some such.

If we agree on this among ourselves and communicate it to users, hopefully that’ll help everybody.

A couple years ago I signed up for Project Honeypot, which is a distributed network of fake email domains set up to catch spam for research purposes. All I had to do was create a subdomain off of a domain I already had (I didn’t use any WOU resources for this) and set it up to point to the Project Honeypot servers, and then forget about it. They don’t even need access to my site or anything.

So anyway, I hadn’t thought about this in a while, but this morning they sent me a notification that they’d caught their one billionth spam message (which happened to be an IRS phishing scam, in case you’re curious.) They also included some statistics (Quoted from their email:)

• Monday is the busiest day of the week for email spam, Saturday is thequietest
• 12:00 (GMT) is the busiest hour of the day for spam, 23:00 (GMT) is the quietest
• Malicious bots have increased at a compound annual growth rate (CAGR) of 378% since Project Honey Pot started
• Over the last five years, you’d have been 9 times more likely to get a phishing message for Chase Bank than Bank of America, however Facebook is rapidly becoming the most phished organization online
• Finland has some of the best computer security in the world, China some of the worst
• It takes the average spammer 2 and a half weeks from when they first harvest your email address to when they send you your first spam message, but that’s twice as fast as they were five years ago
• Every time your email address is harvested from a website, you can expect to receive more than 850 spam messages
• Spammers take holidays too: spam volumes drop nearly 21% on Christmas Day and 32% on New Year’s Day

You can find lots more here.