Kansas State University



Month: September 2018

Phishing Scam – 9/28/2018 – Important Message from KSU.

URL is blocked at the border, sent to Trend. Web Host was notified.

From: “IT Administrator”
Date: September 28, 2018 at 2:48:21 PM EDT
Subject:Important Message from KSU.
Due to security update on our server, some non-active accounts will be shut down and this requires you to validate your email account within 24 hours, to keep your account active. kindly click below.
Please Click here to Update your K-state Email account. [http://scropu.cf/secure/]
The message will be available in your Secure Message Center.
 Best Regards,
Kansas State University.

Phishing Scam – Your account has been temporarily disabled – 09/26/18

Trendmicro has identified last link as dangerous, blocked at the border.

Asunto: [SPAM] Your account has been temporarily disabled
Fecha: 26/09/2018 2:18 pm
Remitente: NetFlix Service <NetFlix@2bitsdev.com>
Destinatario: mfoscolo@fcm.uncu.edu.ar
Responder a: NetFlix@2bitsdev.com

Sorry for the interruption, but we are having trouble authorizing your
Payment Method.
Please visit the account payment page at
https://www.netflix.com/YourAccountPayment [1] to enter your payment
information again or to use a different payment method.
When you have finished, we will try to verify your account again.
If it still does not work, you will want to contact your credit card
To protect the informations of our customers, our system has temporarily
placed restrictions on your account until your informations has been
validated against our system.
You can validate your informations by either clicking on the link above
or below, this will only take a few minutes and your account functions
will be fully restored.
If you have any questions, we are happy to help. Simply call us at
-The Netflix Team
Netflix Inc. : Netflix Corporate Headquarters 100 Winchester Circle Los
Gatos, CA 95032.
You can un-subscribe to security alerts by configuring your online
We are sending this email to provide support for your personal online
Netflix account.

[1] https://www.revistaasi.com.mx/wp-content/plugins/log/hora/

Reply-To Scam – 09/25/18 – Follow up


From: Charles Taber <charlestaber7@gmail.com>
Sent: Tuesday, September 25, 2018 11:45 AM
To: *******
Subject: Follow up
Are you available?


From: Charles Taber <charlestaber7@gmail.com>
Sent: Tuesday, September 25, 2018 3:34 PM
To: ******* <*******>
Subject: Re: Follow up
I’m in a meeting right now and that’s why i’m contacting you through here. I should have call you, but phone is not allowed to be use during the meeting.I don’t know when the meeting will be rounding up, And i want you to help me out on something very important right away.
 i need you to help me get an iTunes gifts card from the store,i will reimburse you back when i get to the office.
I need to send it to someone and it is very important cause i’m still in a meeting and i need to get it sent Asap.
it one of my best friend son birthday
The amount i want is $100 each in two (2) piece so that will make it a total of $200 l’ll be reimbursing back to you.i need physical cards which you are going to get from the store. When you get them,just scratch it and take a picture of them and attach it to the email then  send it to me here ok

Reply to scam – 9/25/2018 – PURCHASE INQUIRY

Reply to Scam Contacted ISP

Sent: Tuesday, September 25, 2018 5:58:53 AM
To: *********
 Hello Sales,
I would like to make an inquiry about some products. But before i proceed, Please inform me on:
– Private Shipping Company For Pick up?
– Minimum order quantity ?
– If US credit card is accepted ?
– Delivery lead time ?
I would be awaiting to receive the reply as soon as possible.
Delta Tower, Floor 18
Panama City, Republic of Panama
Central America.
Cell: 1-469-353-7822

Phishing Scam – 9/24/2018 – The document you requested for

URL is blocked at the border, sent to Trend. Web Host was notified.

From: *********
Date: September 24, 2018 at 12:36:08 CDT
Subject:The document you requested for
Reply-To:wizzywizze1@gmail.com [mailto:wizzywizze1@gmail.com]
Here is the document you requested, Please inform Peter about this
View document [http://kstateajsdsj.v90.us/]
Google Drive

Phishing Scam – 09/23/18 – E-Mail Storage Affected

URL is blocked at the border, sent to Trend. Web Host was notified.

From: E-Mail Administrator <info@webmaster.com>
Sent: Sunday, September 23, 2018 7:49 PM
To: ***** *****
Subject: E-Mail Storage Affected

Mail Quota: (95% Almost Full)

Attention: **********@ksu.edu
Your email quota has reached 95% and will soon exceed its limit.
Follow the URL below to upgrade your quota to 25GB for free to avoid loss of email data.
Upgrade Email Quota <https://astimelosdime.xyz/bin/rackspace/index.php?email=**********@ksu.edu>

Source: Email Administrator

Phishing Scam – 09/23/18 – K-State eID registration confirmation

URL is blocked at the border, sent to Trend. Web Host was notified.

Sent: Sunday, September 23
Subject: K-State eID registration confirmation
Cannot display this message
Click here to open this message [http://message-Pfel.read-mail-secure.icu/d2045f3a6ef11ce90e5d6ca356a1503f?xfEMw=&Pfel=aGVscGRlc2tAay1zdGF0ZS5lZHU=&Pfel=GpUJdMii]
POP3 message delayed: Pfel – Date: 09/24/2018 12:01:05 (k-state)

Phishing Scam – 09/21/18 – System Administrator

URL is blocked at the border, sent to Trend. Web Host was notified. Webpage does not display.

From: System Administrator <podanji1@uhk.cz>
Sent: Friday, September 21, 2018 3:48 AM
To: System Administrator
Subject: Validate Mailbox
You have Two(2) unread messages but cannot be accessed because your mailbox has exceeds its quota/limit. CLICK HERE  [http://bit.do/exe5n]to use the message retriever page and enter data to access missing messages.

Phishing Scam – 09/19/18 – Important: Your contact details have been changed

URL blocked at the border, Trend is blocking. Web host was notified.

From: Cashplus <online@pol.com>
To: Recipients <online@pol.com>
Sent: Wed, Sep 19, 2018 6:18 am
Subject: Important: Your contact details have been changed
Online Servicing update:
Your contact details have been changed

As part of our security procedures, we’re writing to confirm that your contact details have recently been changed via Online Servicing.
If you requested this change, you don’t need to take any further action as your details have been updated.
If not, please login to review your online account.  >>  www.cashplus.com/update
Kind Regards,
Cashplus Customer Services.