[Action Required] Your Jira subscription will be cancelled in one week

[Michael Farrell]

Hi,

A staff member received an email from <no-reply@xxxxxxxxxx.atlassian.net> with the subject "[Action Required] Your Jira subscription will be cancelled in one week".

The xxxxxxxxx is the staff member's name not a [sitename].

I've replaced the persons name in the address with "xxxxxxxxxx" to anonymise it.

It seems like some sort of phishing attempt and there was no text in the body of the email.

But the Domain name seems legitimate and hovering above the entire address shows the same information (with no typos).

Has anyone seen this type of email before or advice on what steps to take (besides delete it and don't reply)?

Thanks

Michael F

[Abraham Durrant]

If it's from atlassian.net, then it is legit

[Michael Farrell]

Hi Abraham,

Thanks for the reply. I agree it looks legitimate but is odd. I'll see what I can learn.

[David Woo]

I would reach out directly to your account executives from Atlassian of your contacts from Atlassian.  If you don't then I would create a support ticket, it is important for them to confirm and they confirm it is spam, then they need to send a email to the larger audience letting everyone know of a potential fishing that is going on.

[Michael Farrell]

Hi David,

Thanks for the reply.

I'll contact the user first as described in my email to John. I'll then reach out to Atlassian depending on the result. 

[John Funk]

Hi Michael - Welcome to the Atlassian Community!

The title of the email is a legitimate one - just got one yesterday myself. However, the body of the email should not be blank. But the user might have created their own new site using their name and a company email. 

[Michael Farrell]

Hi John,

Thanks for the reply.

I'll discuss the blank content with the user. In case they inadvertently (or on purpose) removed it.

I'll also ask if they created their own site (unlikely but possible).  

[John Funk]

Actually, I think that is the likely scenario whether they admit to it or not. Otherwise who could create a new site using their name? 

[Michael Farrell]

Hi John,

The email was not blank (what I received was though). I've now received the full message and yes, it seems real and they did create the site.

In the back of my mind was the possibility of some form of impersonation but not after seeing the full message.

[John Funk]

Good - glad you got it sorted out. I have a personal site I created also, so I could tell the email was legit. Best of luck!