Kansas State University



Month: October 2018

Phishing Scam – 10/25/18 – We’ve updated your contact information

URL is blocked at the border, sent to Trend. Web Host was notified.

To: “**********”
> Subject: We’ve updated your contact information
> Reply-To: “wizzywizze1@gmail.com” <wizzywizze1@gmail.com>
> wellsfargo.com
> We’ve updated your contact information
> Phone Number: (***) ***-8724
> To get more details or make corrections, go to update contact information.
> If you didn’t make this request, please Click Here
> Thank you for banking with Wells Fargo.
> Wells Fargo Online Customer Service
> wellsfargo.com | Fraud Information Center
> Note: You may also receive this alert if you are a “Guest User” with view-only access on another customer’s account. The Administrator on those accounts may have recently updated your email address. Please contact the Administrator for assistance.
> Please do not reply to this automated email.
> 3f8297d5-7edb-4d12-977c-f3d3232de1c36

Phishing Scam – 10/24/18 – Microsoft account team

URL is blocked at the border, sent to Trend. Web Host was notified.

From: Ralf Peter Greif
Subject: Microsoft account team
Date: October 24, 2018 at 10:46:34 AM CDT
To: “in@accountteam.com [mailto:in@accountteam.com]”
This message is being sent to you to inform you that your Microsoft Account will expire soon if not updated, we notify you due to the resent update in our database.
If you wish to continue using this account please do click on Update [https://sevicede2.wixsite.com/mysite] and upgrade to our services. Ignoring this message will cause the account to be closed
Note: This upgrade is required immediately after receiving this message
Thank you
Account team.

Phishing Scam – 10/22/18 – Help Desk

URL is blocked at the border, sent to Trend. Notified web host.

Dear staff / employees,
We are migrating all email accounts to the new web application 2018. Update your email account below, so that the update and migration can take effect now. This is done to improve the security and efficiency due to unwanted emails received recently.
To also prevent your email from being deleted from our server >>> VERIFY [http://infofastloanservice001.000webhostapp.com/] <<< Please note that, if you do not verify your email address before Monday October. 29, 2018, your email account will be deactivated. Thank you for using our web-mail account. Office of Information Technology Services (ITS) Esta comunicación (incluidos sus anexos) es Información Confidencial, dirigida exclusivamente a su destinatario, quien deberá resguardar la confidencialidad. Queda prohibido la divulgación, modificación, reproducción o uso de la información aquí contenida por cualquier otra persona que no sea su destinatario. Si Ud. ha recibido este mail por error, le agradeceremos nos lo informe a la brevedad respondiendo a este e-mail a la dirección del remitente, destruya las copias y por favor, borre de su sistema el mensaje recibido. This message (including any attachments) constitutes Confidential Information, and is intended for the exclusive use of the named addressee, who shall preserve its confidentiality. Readers of this message other than the intended recipient are forbidden to disseminate, modify, distribute or reproduce this message. If you have received this email in error please notify us immediately by replying to the sender of this message, discard any copies, and delete this message from your system.

Phishing Scam – 10/18/18 – All Signed

URL is blocked at the border, sent to Trend. The Web Host was notified.

From: C21laney (Carol Laney) [mailto:c21laney@aol.com]
Sent: Thursday, October 18, 2018 5:30 PM
Subject: Re: All Signed
I have no idea what this is and refuse to open it until I do.
—–Original Message—–
From: ************
Sent: Thu, Oct 18, 2018 4:46 pm
Subject: FW: All Signed
Congratulations, all parties have signed!


Phishing Scam – 10/18/18 – complete your password request

URL is blocked at the border, sent to Trend. The Web Host was notified.

From: Account Security Notice
Sent: Thursday, October 18, 2018 8:34 AM
To: **********
Subject: complete your password request
 Microsoft Outlook Office365
Your New Password Request
Your password reset is in process and your current password will be disabled shortly
The password reset link will be forwarded to the new optional email submitted
Ignore this email notification, your request will take effect shortly
If you did not request this password reset
Use the Cancel Request button below to cancel the password reset and keep your account safe
Cancel Request [https://b0lte-online.com/s0?email=**********@k-state.edu]
This action will take a brief period before this request takes effect
This is a compulsory communication about the service. To set communication preferences
for other cases.
This message was sent from the email address is not monitored. Do not reply to this message.
Privacy | Legal Notices
Microsoft Corporation
600 Pine Street, Suite 352,
WA 98101, USA.

Reply-to Scam – 10/10/18 – FROM MARIA GLADYS HUGO

Reply-To Phishing Scam.

From: Maria Hugo <mariahugo84@yahoo.com>
Sent: Wednesday, October 10, 2018 9:19 AM
With Due Respect and Humanity, I was compelled to write to you under a humanitarian ground, however, this is not mandatory nor will I in any manner compel you to honor against your will.I am Mrs Maria Gladys Hugo, Am 55 years old with my only daughter, Miss Merit Hugo, 17years old.

Please I am contacting you to let you know my desire to establish a charity foundation in your country with this sum of US$18.Million (Eighteen Million thousand dollars) which I inherited from my late husband (Dr.Anthony Hugo) It is my desire to see that this money is invested to any organization of your choice in your country and distributed each year among the charity organizations, motherless baby’s home, mosques, churches, Schools, supporting destitute aged men and women or whatever you may have in mind that will be to the benefit of the less fortunate.Also use part of this money to take care of my only daughter,Miss Merit Hugo.

I took this decision because I was raised from a motherless baby’s home and Presently, I’m hospitalized where I am undergoing treatment for my upcoming breast cancer surgery operation. Please reply as soon as possible, confirming your acceptance to this proposition so that I will give you all the relevant information that will authorize the release and transfer of the fund to you as my duly assigned representative.
On this note,I contacted you to please come in as my daughters guardian/ appointee of new beneficiary to this funds to enable the bank transfer the money in your foreign account. The bank has given us requirements we should forward to them. Please you send us the information below as requested by the bank officer here.When we receive this information we will submit it to the bank through my late husband`s Attorney.
1. Your full name:
(2) office or house full address:
(3) Your tel,cel phone number:
(4) Your occupation & position:
(6) A copy of Your ID
Strictly for less privileged home from Mrs Maria G Hugo,
Thank you in advance for your Consideration and I look forward hearing from you shortly.
Mrs Maria.G.Hugo

Phishing Scam – 10/11/18 – Incoming messages Error

URL is blocked at the border, sent to Trend. Web Host was notified.

From: Support Team.
Sent: Thursday, October 11, 2018 10:43 AM
To: *******
Subject: Incoming messages Error.
We noticed your lwidenor@ksu.edu [mailto:lwidenor@ksu.edu] failed to sync and returned (5) incoming messages.
This is due to a server error on your e-mail
Recover_Messages [https://idahobuildinginspections.gb.net/671/254/?hr3=*******@ksu.edu]
2018 Message Center


URL blocked at the border and Trend is blocking.

Email Has Expired !!!
Dear User *********,
Just a friendly reminder that your email account has expire more than 3 days and will be terminated tomorrow. We already sent you a mail last week, but in case you missed it, You still have until tomorrow to Reactivate your account
This is for your own safety to continue using your Email account. Click the Re-activate button below now.


As soon as you have Re-activate your email account, all your features will start working effectively.
Note: Please do not ignore this notification or your account will permanently deleted from our data base
If you have any questions feel free to contact our support. Thanks,

Phishing Scam – 10/11/18 – Your Account Will Be Disconnected And Deleted

URL blocked at the border and Trend is blocking.

> From: “Email Security”
> Date: October 10, 2018 8:28:59 PM EDT
> To: *******
> Subject: Your Account Will Be Disconnected And Deleted
> Admin Team
> Hi
> Your account of ******** will be disconnected from sending or receiving mails from other users because you failed to resolve errors on your mail.
> Kindly Verify here or you will be disconnected from using this account.
> We hope to serve you better.
> Regards,
> The Mail Team
> This notification was sent to *********