{"id":1103,"date":"2023-05-22T14:44:58","date_gmt":"2023-05-22T21:44:58","guid":{"rendered":"https:\/\/blogs.pugetsound.edu\/infosec\/?p=1103"},"modified":"2023-05-22T16:17:19","modified_gmt":"2023-05-22T23:17:19","slug":"phishing-email-from-5-22-2023-new-returned-messages","status":"publish","type":"post","link":"https:\/\/blogs.pugetsound.edu\/infosec\/the-phish-tank\/1103","title":{"rendered":"Phishing Email from 5\/22\/2023: &#8220;New returned messages&#8221;"},"content":{"rendered":"\n<p class=\"has-large-font-size\">Original Phishing Message<\/p>\n\n\n\n<p><strong>From<\/strong>: Puget Sound &lt;viktoriia.zemliak[@]uni-osnabrueck[.]de><br><strong>Subject<\/strong>: New returned messages<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"419\" src=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/05\/5-22-23-returned-message-phish-1024x419.jpg\" alt=\"\" class=\"wp-image-1104\" srcset=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/05\/5-22-23-returned-message-phish-1024x419.jpg 1024w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/05\/5-22-23-returned-message-phish-300x123.jpg 300w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/05\/5-22-23-returned-message-phish-768x314.jpg 768w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/05\/5-22-23-returned-message-phish.jpg 1046w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"has-large-font-size\">Tips for Detection<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Always hover over links in emails.\u00a0The link in this email goes to dacewebsolutions[.]com\/sitemap\/hilight\/login[.]pugetsound[.]html. This is not a Puget Sound site nor the site to check university email.<\/li><li>The message was sent from viktoriia.zemliak[@]uni-osnabrueck[.]de. Legitimate notices about your account will generally come from an @pugetsound.edu address.<\/li><li>Many phishing emails contain messaging claiming that you have new voicemails, rejected\/quarantined emails, required maintenance, deactivation of accounts, etc.<\/li><\/ul>\n\n\n\n<p class=\"has-large-font-size\">Text of Phishing Message<\/p>\n\n\n\n<p><strong>From<\/strong>: Puget Sound &lt;viktoriia.zemliak[@]uni-osnabrueck[.]de><br><strong>Subject<\/strong>: New returned messages <\/p>\n\n\n\n<p>Recipient: [<em>username<\/em>]@pugetsound.edu<\/p>\n\n\n\n<p>(3) new e-mails were returned to the sender(s) due to maintenance.<\/p>\n\n\n\n<p>Please follow below link for a preview of failed messages.<br>View Here<\/p>\n\n\n\n<p>Sorry for the inconvenience caused.<br>Thank Y\u03bf\u03c5.<br>University of Puget Sound.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Original Phishing Message From: Puget Sound &lt;viktoriia.zemliak[@]uni-osnabrueck[.]de>Subject: New returned messages Tips for Detection Always hover over links in emails.\u00a0The link in this email goes to dacewebsolutions[.]com\/sitemap\/hilight\/login[.]pugetsound[.]html. This is not a Puget Sound site nor the site to check university email. The message was sent from viktoriia.zemliak[@]uni-osnabrueck[.]de. Legitimate notices about your account will generally come from [&hellip;]<\/p>\n","protected":false},"author":521,"featured_media":1104,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[3,4],"class_list":["post-1103","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-phish-tank","tag-phishing","tag-phishtank"],"_links":{"self":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/1103","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/users\/521"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/comments?post=1103"}],"version-history":[{"count":2,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/1103\/revisions"}],"predecessor-version":[{"id":1107,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/1103\/revisions\/1107"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/media\/1104"}],"wp:attachment":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/media?parent=1103"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/categories?post=1103"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/tags?post=1103"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}