Kansas State University

search

Scams

Month: August 2018

Phishing Scam – 08/29/18 – [Action Required] You have 6 Incoming Messages

URL is blocked at the border, sent to Trend. Notified web host.

From: Message Center &lt:admin@emsmca.co.za>
Sent: Wednesday, August 29, 2018 7:58 AM
To: ******** ******** &lt:********@ksu.edu>
Subject: [Action Required] You have 6 Incoming Messages
24/7 Support: +1 (344) 841 2496
Microsoft — Special Message
Hi ********@ksu.edu [mailto:********@ksu.edu]
Attention: matteson@ksu.edu [mailto:********@ksu.edu] We Detected you have [6] undelivered incoming emails on 22-Aug-2018,this is because your account storage is full, your action is required for them to be delivered 
Kindly follow the self service instructions below to rectify the issue: 
Release pending messagess → [http://screen.myftp.biz/hatqlj47av].
This digest email may not include all Message Center announcements from the past week. It is personalized for your organization and reflects your individual preferences. Microsoft [https://click-email.godaddy.com/7x6o9lyQCtXsxRUyIQ9OTC/?eid=emp.oeg.transactional.3248.None.None.None&marketId=en-US&currencyId=USD&redir=http%3A%2F%2Fwww.godaddy.com%2FAgreements%2FShowDoc.aspx%3Fpageid%3DREG_SA%26prog_id%3DGoDaddy%26isc%3DGDBBX3248%26utm_source%3Dgdocp%26utm_medium%3Demail%26utm_campaign%3Den-US_x_email_base_gd%26utm_content%3D180817_3248_x_x_x_x_GDBBX3248_7x6o9lyQCtXsxRUyIQ9OTC].
Please do not reply to this email. Emails sent to this address will not be answered.
Copyright © 1999-2018 Microsoft Operating Company, LLC. 14455 N. Hayden Rd, Ste. 219, Scottsdale, AZ 85260 USA. All rights reserved.

Phishing Scam – 8/27/2018 – Office-365 Team

URL is blocked at the border and sent to Trend. The web host was notified.

From: Administrators Team <0J9AW5TFaTFXxEk8vnji.L1dkWauoKNiYfrep.account-security-noreply@ITMicrosoft.com.mail.microsoftmsa.msidentity.com>
Sent: Sunday, August 26, 2018 1:26 PM
To: ***********
Subject: Re: Office-365 Team
Dear *********
You registered but you still haven’t confirmed the Address associated with your email.
You won’t be able to use your Email until you let us know that this address belongs to you.
Just follow the instruction below to confirm your account
Confirm Account [https://infuriatedcsf.vg.tc/ks.php?m=airport&c=passenger_guide&id=10&aid=1]
Regards,
Office Team

Phishing Scam – 08/23/18 – FW: A document was sent to you to review and sign

URL is blocked at the border and sent to Trend. The web host was notified.

From: DocuSign
Sent: Thursday, August 23, 2018 12:25 PM
To: ******** ********* <********@ksu.edu>
Subject: A document was sent to you to review and sign
A document was sent to you to review and sign
[https://qx528.infusionsoft.com/app/linkClick/2/1707d60bc783a9b6/968/d98553d6b1fd7878]
Unsubscribe [https://qx528.infusionsoft.com/app/optOut/0/b8a3ab98fe6d1ba8/968/d98553d6b1fd7878]
DocuSign 5220 Augustine Herman Hwy Earleville, Maryland 35463 United States

Phishing Scam – 08/23/18 – FW: Confirm Your Account

URL is blocked at the border, sent to Trend. Web Host was notified.

Subject: FW: Confirm Your Account
From: Support-Team <du46@poies.org [mailto:du46@poies.org]>
Sent: Thursday, August 23, 2018 5:30 AM
To: ******** ******** <********@ksu.edu [mailto:********@ksu.edu]>
Subject: Confirm Your Account
OFFICE.365 TEAM
Your office.365 mail is out of date, and you may not be able to send or receive new messages. We recommend you confirm your mail-box within 12 hours.
CONFIRM..NOW [http://timetoday.in/.llc/.llc1/?email=********@ksu.edu]
Note: Failure to confirm your mail-box will result to permanent disable.
Regards,
Microsoft 2018 Team

Phishing Scam – 08/21/18 – Carol & Glenn Fogo Invoice # 95761880892 08/21/2018

URL blocked at the Border, Trend is blocking. Web host has been notified.

From: Carol & Glenn Fogo <administracion@inmuebleshahn.com>
Sent: Tuesday, August 21, 2018 10:50 AM
To: ********** <*********@ksu.edu>
Subject: Carol & Glenn Fogo Invoice # 95761880892 08/21/2018

Your invoice appears below. Please remit payment at your earliest convenience.
Thank you for your business – we appreciate it very much.
http://hfconsul.com/files/En_us/Open-invoices

Thank you,
Carol & Glenn Fogo
Phone: 281-636-3306 Ext 32#
Fax: 281-733-7623

Phishing Scam 8/20/2018 – Your subscription expires on Aug 22, 2018

The URL is blocked at the border, sent to Trend. Web Host was notified.

From: Office O365
Date: Monday, August 20, 2018 at 10:20 AM
To: *********
Subject: Your subscription expires on Aug 22, 2018
Hello, 
Your subscription expires on Aug 22, 2018.
To keep using Outlook, please follow this link and click “Renew now”.
Renew Subscription [https://wcs.com.pa/SOS/?mes1=********]
Your subscription ID is 18314727.
If there’s anything we can help you with, please live chat with Support [https://wcs.com.pa/SOS/?mes1=*********] or reply to this email.
— The Office O365 Team

Phishing Scam – 08/18/18 – KSU

The URL is blocked at the border, sent to Trend. Web Host was notified.

From: ******* *******
Sent: Saturday, August 18, 2018 8:12 AM
To: ******* *******
Subject: KSU
 Due to a recent Phishing email that has been going around the KSU most Student/Staff Service accounts have been compromised.
Your account access has been indefinitely revoked. Log on to KSU Self Service to have your account verified and reactivated now.
Click here to log on [http://www.123formbuilder.com/form-4079397/Kstateedu]
Thank you,
Computers Service Help Desk
To stop receiving messages from IT Team Projects [https://outlook.office365.com/owa/itacitteamprojects@KSUemailProd.onmicrosoft.com/groupsubscription.ashx?realm=KSUemailProd.onmicrosoft.com&source=EscalatedMessage&action=conversations] group, stop following it [https://outlook.office365.com/owa/itacitteamprojects@KSUemailProd.onmicrosoft.com/groupsubscription.ashx?realm=KSUemailProd.onmicrosoft.com&source=EscalatedMessage&action=unsubscribe].

Phishing Scam – 8/19/2018 – KSU

Blocked at the border, sent to Trend. Web Host notified.

Email From: melissamouras@optusnet.com.au
Email Body:

Due to a recent Phishing email that has been going around the KSU
 
most Student/Staff Service accounts have been compromised.
Your account access has been indefinitely revoked. Log on to KSU
 
Self Service to have your account verified and reactivated now.
Click here to log on [http://www.123formbuilder.com/form-4079397/Kstateedu]
Thank you,
Computers Service Help Desk
————————-
Email sent using Optus Webmail

Phishing Scam – 8/17/2018 – Zimbra Webmail Team

Blocked at the border, sent to Trend. Web Host notified.

From: ZIMBRA
Sent: Friday, August 17, 2018 5:31 AM
Subject: Zimbra Webmail Team
 Dear User,
Your mailbox has exceeded the storage limit defined by the administrator and can not send or receive new messages until you validate your e-mail. xxxxxxxx@ksu.edu
Click HERE  [http://etuiothherr.ml/]to confirm your e-mail.
Thank you
Administrator ISERV WebMail!
Case number: 894162
ZimbraWebmail,
Copyright 2018

Phishing Scam – 8/17/2018 – System Admin

Blocked at the border, sent to Trend. Web Host notified.

From: ZIMBRA
Sent: Thursday, August 16, 2018 6:56 PM
Subject: System Admin
 We are upgrading our email system to Wab Mail Zimbra Ksu.edu 2018. This service creates more space and easy access to email. Please update your account by clicking on the link below and fill out the information for activation.CLICK HERE http://etuiothherr.ml/ [http://etuiothherr.ml/]
 Inability to complete the information will keep your account inactive.
thanks.
IT Admin Desk