How to Spot Fake Cisco Umbrella Security Alert Emails Targeting Australian Small Businesses

Summary

This guide helps you troubleshoot and resolve: How to Spot Fake Cisco Umbrella Security Alert Emails Targeting Australian Small Businesses. Follow the steps below to fix the issue.

Common Causes

Fake Cisco Umbrella security alert emails are targeting Australian small businesses by impersonating legitimate network security notifications. These phishing messages attempt to steal login credentials or trick recipients into installing malware by claiming there is a security threat on their network. Knowing how to identify these fraudulent emails helps protect your business data and prevents unauthorised access to your systems.

Quick Fix Steps

1. Do not click any links or open attachments in the suspicious email.
2. Check the sender email address for misspellings or unfamiliar domains.
3. Hover over links to reveal the actual destination URL before clicking.
4. Log in to your Cisco Umbrella dashboard directly by typing the address into your browser, not by using email links.
5. Report the email as phishing and delete it from your inbox.

Detailed Instructions

Identify Red Flags in the Sender Address

Phishing emails often use sender addresses that look similar to legitimate ones but contain subtle differences. Look for:

• Public email domains such as @gmail.com, @outlook.com, or @yahoo.com instead of an official Cisco domain.
• Misspelled domain names such as cisco-umbrella-security.com or umbrella-cisco.net.
• Extra characters or numbers added to the domain name.
• Sender names that say "Cisco Umbrella Team" but use an unrelated email address.

Inspect Links Before Clicking

Hover your mouse over any link in the email without clicking to see the actual destination URL in the bottom corner of your email client or browser. Be cautious if:

• The link does not point to an official cisco.com or umbrella.com domain.
• The URL uses an IP address instead of a domain name.
• The link contains random strings of characters or shortened URLs.
• The displayed text says one thing but the hover preview shows a different address.

Check for Urgent or Threatening Language

Fake security alerts often use pressure tactics to make you act quickly. Watch for phrases such as:

• "Your network security has been compromised"
• "Immediate action required to prevent data loss"
• "Your Umbrella subscription has been suspended"
• "Click here to verify your identity now"

Access Cisco Umbrella Safely

1. Open your web browser.
2. Type the official Cisco Umbrella login address directly into the address bar. Do not copy and paste from the email.
3. Log in using your usual credentials.
4. Check for any genuine alerts or notifications inside the official dashboard.
5. If there are no alerts in the dashboard, the email was fraudulent.

Report and Delete the Email

1. In your email client, select the suspicious message.
2. Use the Report phishing or Report junk option if available.
3. Delete the email from your inbox.
4. Empty your Deleted Items or Trash folder to remove it completely.

Troubleshooting

If You Already Clicked a Link

1. Disconnect your device from the internet immediately.
2. Run a full antivirus scan on the affected computer.
3. Change your Cisco Umbrella password and any other accounts that use the same password.
4. Enable multi-factor authentication if it is not already active.
5. Open a Ticket with 220 Internet Services so we can help assess any potential exposure.

If You Entered Login Details

1. Change your Cisco Umbrella password immediately from a trusted device.
2. Check your account for any unauthorised changes to security settings or DNS configurations.
3. Reset passwords for any other accounts that shared the same credentials.
4. Contact your IT support provider to review your network security logs.

Still Having Issues?