Phish 2013-05-08 #2

Another phish sent to around 100 people this morning.  We were only forwarded the body of the phish so we do not have full headers.  Mail logs show that the claimed sender was

Screen Shot 2013-05-08 at 11.57.37 AM

They put some effort into this because they used “ITS Help DESK”, but why is there a comma?  Plus the usual signs that is a phish:

  1. What are “IP Security upgrades”?
  2. Grammatical and typographical mistakes.
  3. Non-USC link which was not disguised at all.  We have seen many phish forms hosted at lately.
  4. The odd Copyright 2013.