User menu

Menu

Main menu

With Subject Line: DT, db, or bD

The non-Lehigh URL, http://webbmail-vcu.bravesites.com/ (note that it ends in bravesites.COM, not LEHIGH.EDU) is a clue that this is a phishing message.

If you are a Gmail user, you can mark it as Phishing by opening the message and:
1. At the top-right corner of the message, click the down arrow next to the "Reply" button.
2. Select Report Phishing.

Phishing Example Image: