Kansas State University

search

Scams

Month: March 2018

Please beware of this KPERS phishing scam

The URL is blocked at the border and sent to Trend. The web host was notified.

Warning!

Hacker Impersonating KPERS

A foreign hacker trying to impersonate KPERS though email has contacted one of our employers. We wanted to let you know to be on the lookout for email coming from the domain ‘kpens.org.’ This is not us.

If KPERS staff members ask for invoices and other financial information, we would have generally called you first. And we use a secure email system for confidential and sensitive info.

If you have received an email request and you have not discussed it with someone at KPERS, please call or email us directly to confirm it’s a legitimate.

Questions?

· Email employers@kpers.org

· Toll-free 1-888-275-5737

· In Topeka 785-296-6166

Phishing Scam – 3/30/2018 – [IDM-DEV-L] USER UPDATE

URL is blocked at the border, sent to Trend. Web Host was notified

From: Identity Management Development on behalf of Webmail <012809972275@TRE-AM.JUS.BR>
Sent: Friday, March 30, 2018 1:59 AM
To: idm-dev-l@listserv.ksu.edu
Subject: [IDM-DEV-L] USER UPDATE
Your mailbox has exceeded one or more administrator-defined size limits. Your mailbox size is 164899 KB. You are receiving this warning when your mailbox reaches 160000 KB mailbox size limits: Account would be disabled only if the account owner declines to validate the account within 48 hours of receiving this notice. To reset and re-validate kindly CLICK HERE OR COPY LINK AND PAST IN YOUR BROWSER
Enable here: https://formcrafts.com/a/34094 [https://formcrafts.com/a/34094]
404 – Not Found [https://formcrafts.com/a/34094]
formcrafts.com
FormCrafts is an online form building tool for making awesome forms, lightning fast.

Phishing Scam – 3/29/2018- Review Recent Activity(s)

URL is blocked at the border, sent to Trend. Web Host was notified

From: Alērtß@m¡crosftonline.onl¡nē
Sent: Thursday, March 29, 2018 2:40 PM
Subject: Review Recent Activity(s)
Your e-mail account was just signed in to from a new device. You’re getting this email to make sure it was you.
Please go to your account activ¡ty page to let us know whether or not this was you. This is to help keep you safe, no actions needed if the activity page takes you right back to your mail.
Review_Recent_ Activities [https://smsdosend.tk/content]
To opt out or change where you receive security notifications, Click here.

Phishing Scam – 3/29/19 – Validation required for your Zoominfo account

URL is blocked at the border, sent to Trend. Web Host was notified

From: Zoominfo
Sent: Thursday, March 29, 2018 9:15 AM
To: contacts@alert-zoominfo.com
Subject: Validation required for your Zoominfo account
We detect some unusual activities in your your ZoomInfo account, therefore, your account was added to the validation queue. You are required to confirm the ownership of this account, Click here to continue [https://x.co/J4J4J4J4/?=%3c%3cEMAIL%3e%3dht/]. Our system will automatically delete and disable accounts with wrong credentials.
Best,
ZoomInfo
*Remember to enroll your new list in Everfresh notifications to automatically find net new contacts through monthly or quarterly updates.
Zoom Information, Inc.
307 Waverly Oaks Road [https://maps.google.com/?q=307+Waverly+Oaks+Road+Waltham,+MA+02452+USA&entry=gmail&source=g]
Waltham, MA 02452 USA [https://maps.google.com/?q=307+Waverly+Oaks+Road+Waltham,+MA+02452+USA&entry=gmail&source=g]
Contact [http://www.zoominfo.com/business/about/contact-us] | Unsubscribe [http://www.zoominfo.com/unsubscribe]
[https://www.facebook.com/ZoomInformation?mtcCampaign=-1&mtcEmail=911501397] [https://twitter.com/zoominfo?mtcCampaign=-1&mtcEmail=911501397] [https://www.linkedin.com/company/16272?trk=tyah&mtcCampaign=-1&mtcEmail=911501397] [https://plus.google.com/113219309727742350308/videos?mtcCampaign=-1&mtcEmail=911501397]

Your account will be deleted

URL is blocked at the border, sent to Trend. Web Host was notified

From: Microsoft service Teams
Date: March 27, 2018 at 9:54:54 AM CDT
To: <******** [*********]>
Subject:Your account will be deleted
   Microsoft Office Security
Hi *********,
Your e,mail******** [mailto:**********] were place on hold due to our recent security upgrade.kindly update your mailbox to recieve new messages that are pending.
Follow the below to keep your account protected.
UPDATE MAILBOX [http://lion-fitness.ru/i?loge=*********@ksu.edu]
CANCEL UPDATE [http://lion-fitness.ru/i?loge=*********@ksu.edu]

©2018 Office 365. All rights reserved. NMLSR ID 399801

Phishing Scam – 03/26/18 – Invoice 117952 from CivicPlus

URL is blocked at the border, sent to Trend. Web Host was notified

From: CivicPlus <invoice@email.civicready.com&lt
Sent: Monday, March 26, 2018 12:03 PM
To: ******** ********
Subject: Invoice 117952 from CivicPlus
CivicPlus  

Invoice   Due:04/02/18
116825 Amount Due: $1145.00

To Customer :
Your invoice appears below. Please remit payment at your earliest convenience.
View Invoice [http://celsiumoftesla.ga]
Sincerely,
CivicPlus

Phishing Scam – 03/26/18 – Your account will be deleted

URL is blocked at the border, sent to Trend. Web Host was notified.

Sent: Monday, March 26, 2018 9:33 AM
To: ********
Subject: Your account will be deleted
   Microsoft Office Security
Hi ********,
Your e,mail ********@k-state.edu were place on hold due to our recent security upgrade.kindly update your mailbox to recieve new messages that are pending.
Follow the below to keep your account protected.
UPDATE MAILBOX [http://bluesky-oz.ru/i?email=********@k-state.edu]
CANCEL UPDATE [http://bluesky-oz.ru/i?email=********@k-state.edu]

©2018 Office 365. All rights reserved. NMLSR ID 399801

Phishing Scam – 03/21/2018 – Your Account Is Deleted & Closed

URL is blocked at the border, sent to Trend. Web host notified.

From: Microsoft Teams <ms-oxprotp@mssimple.apcprd01.prdexchangpe11.net>
Sent: Wednesday, March 21, 2018 11:47 AM
To: K-State *******
Subject: Your Account Is Deleted & Closed
 Office-365

Hi *******
  Your account of *******@k-state.edu will be disconnected from sending or receiving mails from other users because you failed to resolve errors on your mail.
Confirm your [https://qwoifxn.ml/wae/cc/mailOffice365/index.php?email=*******@k-state.edu]activities here [https://qwoifxn.ml/wae/cc/mailOffice365/index.php?email=*******@k-state.edu]
We hope to serve you better.
Regards,
The Mail Team
This notification was sent to *******@k-state.edu of Microsoft.com.

Phishing Scam – 03/20/18 – ********@ksu.edu Verification Request Account Will Be Blocked 20 Mar 2018

The URL is blocked at the border. Trend is already blocking the URL. The Web Host was notified.

From: ksu.edu <customerlogin@syben.com>
Sent: Tuesday, March 20, 2018 7:20 PM
To: ******* ********
Subject: ********@ksu.edu Verification Request
Account Will Be Blocked 20 Mar 2018 ,

Dear *******,
This message is being sent to inform you that your email is to be terminated at 20 Mar 2018.
If you wish to continue using this account ********@ksu.edu please upgrade to our services. Ignoring this message will lead to closure of your email account ********@ksu.edu .

ACTIVATE ACCOUNT NOW

Note: This upgrade is required immediately after receiving this message
Thank you
ksu.edu 2018