This phish typically originates from a non-Cornell account. The sender may appear as "Cornell | EML-Share Service <info@ithaicar.com>". The original email may be blank, the email depicted below is included as an attachment with a different subject. The link within directs to a fake login page. Do not follow the link nor reply to the sender. If you entered your credentials into the linked page, change your NetID password immediately at https://netid.cornell.edu.