Remove “Online Webmail Deactivation” email scam

The “Online Webmail Deactivation” email is part of a phishing campaign that targets users’ email login credentials. It’s a generic phishing attempt, disguised as an email from the email service provider, supposedly informing recipients that an unusual login has triggered the email account to be temporarily blocked for security reasons. Users will supposedly be unable to use their accounts unless they reenable them by clicking on the provided button. However, if users were to interact with the email and do as asked, they would be taken to a phishing site where their login credentials would be phished by malicious actors.

 

 

The “Online Webmail Deactivation” email is a classic phishing attempt, very generic and immediately identifiable as malicious. It informs recipients that there has been an unidentified login, which triggered a security measure that blocked access to the account. The email says that recipients have to unblock the account within 48 hours to prevent it from being permanently blocked. The email is supposed to look like a security alert from the email service provider, but it’s a very poor attempt.

Clicking on the provided link will lead you to a phishing site that somewhat resembles the official login page of your email provider. This phishing page prompts you to enter your login details, which are then captured by cybercriminals behind this phishing campaign. Cybercriminals may use the stolen information themselves or sell it to others with malicious intent.

Email login credentials are especially sought after because email accounts usually contain sensitive information and are linked to numerous other accounts. Gaining access to an email account allows cybercriminals to exploit various services and even potentially blackmail the account holder.

The full text from the “Online Webmail Deactivation” phishing email is below:

Subject: New E-message upgrade security from –

Online Webmail Deactivation ©

Dear User –
We detected something unusual about a recent sign-in for the Email account. For example, you might be signing in from a new location, device, or app.

Your – account has been placed on temporary block, it would be permanently blocked if you do not unblock within 48hours.

To help keep you safe, we’ve blocked access to your in-box, contacts list, and calendar for that sign-in. Please review your recent activity and we’ll help you take corrective action. To regain access, you’ll need to confirm that the recent activity was yours by resigning your account again.

Click here to unblock your account

Note:
Failure to unblock your e-mail account. it will be permanently disabled.
Thank you for using our service.(-)

Email Administrator Security Team™

How to recognize phishing emails

Many phishing campaigns are easy to recognize due to their generic nature, including this “Online Webmail Deactivation” email. These campaigns often target many users with the same email, which is why they’re so generic. On the other hand, phishing attempts aimed at high-profile individuals or organizations tend to be more sophisticated and can be trickier to identify. Luckily, most people mainly encounter the more common, generic phishing emails.

When you receive unsolicited emails, the first step is to verify the sender’s email address. Sometimes, it’s obvious that the address is malicious, as is the case with the “Online Webmail Deactivation” email. In other cases, it may seem legitimate as malicious actors use various tactics to make the email addresses appear more professional and real. We strongly recommend researching the addresses before taking any action requested in the email. Often, a simple Google search can be helpful.

Watch out for grammar and spelling errors as well; legitimate emails are usually well-written, while low-effort phishing attempts often contain numerous mistakes. Even when an email appears more polished, pay attention to awkward phrasing and the use of greetings like “Dear User”, as these are common signs of phishing. Reputable companies usually address you by your name in their correspondence, and you will not find any grammar/spelling mistakes in them.

Lastly, it’s best to avoid clicking on any links in unsolicited emails. If you receive an email about a supposed issue with your account, log in manually to your account through a web browser to check for any problems instead of clicking on links provided in the email. Additionally, always scan any attachments from unsolicited emails with an anti-malware program or use VirusTotal.

How to remove “Online Webmail Deactivation” phishing email

If you get this “Online Webmail Deactivation” email, ignore its content and delete it right away. If you’ve already interacted with the email, clicked on any links, and entered your login details, change your password immediately, provided you still have access to your account. If the email account is no longer accessible, make sure to try all available account recovery options. To reduce the chances of compromising other accounts, disconnect your email from any linked accounts if you can no longer access it.