Kansas State University

search

Scams

Month: August 2020

Phishing Scam – 08/31/2020 – Notification: Microsoft.com Has Failed To Deliver [3] New Emails To *******@

Phishing scam imitating a k-state account. The link it sends leads to a site containing malware. It has been reported in the appropriate channels.

Hi *******@ksu.edu [mailto:*********@ksu.edu],
Notification:Mailexchange.Ecorpconsulting.onmicrosoft.com [http://Mailexchange.Ecorpconsulting.onmicrosoft.com] has failed to deliver [3] new emails from some of your contacts while performing routine services. Reason: Maximum OST/PST size limit exceeded.
You can view them below and choose what happens before they are permanently deleted.
Restore Here [https://001107018.studentserver.com.au/aaa/wpp/index.html#*******@ksu.edu]
This notification was sent from an email address that is not monitored.
Thanks And regards
Copyright 2020 Privacy & Terms

Phishing Scam – 08/28/2020 – Urgent follow up

This is a reply-to scam. The responsible e-mail addresses were reported to the appropriate channels.

From: ****** [mailto:*****.kstate.edu@gmail.com]
Sent: Friday, August 28, 2020 11:13 AM
To: ******
Subject: Urgent follow up
Hello *****,
How are you? Are you available for a quick task?
Best wishes
*********

Professor & Department Head

Phishing Scam – 08/24/2020 – lncoming email delivery failed

Reply-to scam with link. The link has been blocked and reported to the appropriate channels, and so has the email address.

From: Message Center. <y_moriya@nats.ac.jp>
Sent: Monday, August 24, 2020 2:39 PM
To: ******* <*******@ksu.edu>
Subject: lncoming email delivery failed
Office365 has refused the delivery of 3 mails to your *******@k-state.edu inbox 8/24/2020 8:48:00 AM
Retrieve_emails [https://bbox.blackbaudhosting.com/webforms/linkredirect?url=https%3A%2F%2Fmkoe.blob.core.windows.net%2Fber%2FAp3dX.html%23*******@k-state.edu]
Online Services

Phishing Scam – 08/20/2020 – Account De-activation

This is a phishing scam with a link, intended to gather account information. The sender is spoofing a ksu email address. Microsoft, Google, and all server admins have been notified.

From: ksu.edu <noreply@ksu.edu>
Sent: Tuesday, August 18, 2020 9:39 PM
To: ******* ******* <*******@ksu.edu>
Subject: Account De-activation
                       Your account will be disabled! ,
       Dear*******@ksu.edu your account will be deactivated, Aug,19, 2020
        If you want to continue using your email address.
check  [http://u9240382.ct.sendgrid.net/ls/click?upn=AxGaSh59-2BjgdNQEHwiGV3ZW6tG-2FLZ-2Fs9qjen2G1Rd231tE8DirAGondyEhlaMrjzirlzbe9vYziByAhWXNdCv-2FRmGc3g23XJ2t-2BmHXoe0kUCgRv8waBfaUwEdydvPdWWu1S1hd7Q6ofEdybuwQbzKsQ38mr6Bkalc3zBZRsqx04-3DCgwY_wc7g7-2BznbkwsYtCDdgrJT9lyq3Az4OACsa-2BXaQeQdiv7Z4WA3KhAoZvT7qrPBb6zyJ-2BsJhdq8XKr822rOdODTtTQcZM6g-2FJnT4sRStHxMPLI-2F3j6buRzLDp63bkZilpZgZ3o6nAgcrHwBp4D1HfclKZqX65SYMmbfVkZJhpaiI-2BR1GZHs8EE-2FQ5wIOTRTdkQ1N-2B7i4kKlmv4iz5jw-2FkgSA-3D-3D]%0%
        If you do not upgrade your account, you will lose your email                       address.
        Webmail team! ©2020 All rights reserved

Phishing Scam – 08/19/20 – Due:Wednesday, August 19, 2020 k-state.edu

This is a reply-to scam. The e-mail was reported to the appropriate channels.

From: FLORIN, DANIELLE <DFLORIN@YonkersPublicSchools.org>
Sent: Wednesday, August 19, 2020 12:47 PM
To: ****** <*******@ksu.edu>
Subject: Due:Wednesday, August 19, 2020 k-state.edu
Importance: High
k-state.edu
Invoice   Due:Wednesday, August 19, 2020 10:47:07 AM
3010
Amount Due: $64,356.00
Dear Customer: *******@k-state.edu [mailto:*******@k-state.edu],
Your invoice is attached. Please remit payment at your earliest convenience, and contact me with any questions.
Thank you for your business – we appreciate it very much!
Sincerely,
Mary Elsesser
Office Manager
Valentino Pours
847-3546-8101

Phishing Scam – 08/19/20 – ******* Invoice O629130 – unreturned equipment

This is a phishing scam with a link. The responsible e-mail addresses and links were reported to the appropriate channels.

From: ******* <idrotermotecnica@meeclima.it>
Sent: Wednesday, August 19, 2020 1:52 PM
To: ******* <*******@ksu.edu>
Subject: ******* Invoice O629130 – unreturned equipment
 Good Afternoon,
Per your request, attached is a copy of the invoice.
http://helpoc.com/wp-includes/uok63fr97p0_8xmwo_zone/individual_portal/0msdb7lu2u_wt200248/ [http://helpoc.com/wp-includes/uok63fr97p0_8xmwo_zone/individual_portal/0msdb7lu2u_wt200248/]
Thank you for your custom.
*******
Office *******
Fax  *******
e:*******@ksu.edu

Phishing Scam – 08/14/2020 – Task

This is a reply-to scam. The responsible e-mail addresses were reported to the appropriate channels.

From: ******* <executivedirector370@gmail.com>
Sent: Friday, August 14, 2020 6:41 AM
To: ******* <*******@ksu.edu>
Subject: Task
 I’ll need you run a quick task, let me
know if you’re unoccupie
      Thanks
*******

Phishing Scam – 08/10/20 – Action Needed:Password Expiry-Monday, August 10, 2020

Phishing Scam with link.

From: K-state.edu-IT <stephen@redrockestate.co.za>
Sent: Monday, August 10, 2020 2:03 PM
To: ****** <******@ksu.edu>
Subject: Action Needed:Password Expiry-Monday, August 10, 2020
­******@k-state.edu­ ­P­a­s­s­w­o­r­d­ ­e­x­p­i­r­y­. ­O­f­f­i­c­e ­3­6­5­ Hello ******@k-state.edu,
581581Password581581 581581for581581 581581******@k-state.edu581581 581581expires581581 581581today581581 581581
581581You581581 581581can581581 581581change581581 581581 581581your581581 581581password581581 581581or581581 581581continue581581 581581using581581 581581current581581 581581password581581.

<http://www.581581.airductscleaningsanantonio.com/cmVnaXN0cmFyQGstc3RhdGUuZWR1#aHR0cHM6Ly9uei14dHJlbWVmaWdodGVycy5jb20vb28vSUsvb2YxLz80NTMyNjc3NjgmZW1haWw9cmVnaXN0cmFyQGstc3RhdGUuZWR1>
581581Keep581581 581581Current581581 581581Password581581

581581K-state.edu581581 581581Support581581

Phishing Scam – 8/13/2020 – Business Procurement Card Invoice X3097732

This is a phishing scam imitating the Business Procurement Card system at Kansas State. Upon clicking the link in the email it directs to a site that downloads malware onto your device. The email account was reported to the domain website and the page was reported to the webhost.

From: Business Procurement Card <fax964462154@lcrfax-ip2.net>
Sent: Thursday, August 13, 2020 7:47 AM
To: ******* <*******@ksu.edu>
Subject: Business Procurement Card Invoice X3097732
Morning,
It’s a subscription to submit you invoices to us through their system and at the same time you get our business,
then  again I am just assuming on how system works.
http://parisarastgoo.com/dup-installer/lf-rpcqofh22y08lj6-box/verified-area/ACPuYhE7KCB-NyjhIl2t8u/ [http://parisarastgoo.com/dup-installer/lf-rpcqofh22y08lj6-box/verified-area/ACPuYhE7KCB-NyjhIl2t8u/]
Thank you,

Business Procurement Card
Direct #: 852-106-0920
871-777-9800 x916
e:*******@ksu.edu
Let me know if you have any questions.

Phishing Scam – 08/11/2020 – Documents to *******@ksu.edu

This is a phishing scam with a malicious attachment entitled FX-2EFF73.htm. This attachment contains a link used to gather user’s credentials. Google has blocked the malicious link, and Microsoft and other web hosts have been notified.

From: Workplace Ksu Scanner
Sent: Tuesday, August 11, 2020 12:07 PM
To: ******* ******* <********@ksu.edu>
Subject: Documents to ********@ksu.edu
 ***Preview Print File***