{"id":690,"date":"2020-04-30T07:32:18","date_gmt":"2020-04-30T14:32:18","guid":{"rendered":"http:\/\/wynkmarketing.com\/wp-wynk\/?p=690"},"modified":"2020-05-06T09:18:09","modified_gmt":"2020-05-06T16:18:09","slug":"fake-messages-quarantined","status":"publish","type":"post","link":"http:\/\/wynkmarketing.com\/wp-wynk\/blog\/2020\/04\/30\/fake-messages-quarantined\/","title":{"rendered":"Fake Email Messages About Potentially Lucrative Emails That Have been Quarantined"},"content":{"rendered":"

Here’s another one of those fake emails. This one is relatively new in its approach. The Subject line says “WARNING!!! (4) Messages Quarantined<\/strong>” and it comes from “MAIL SERVER ad***<\/span>@*****<\/span>bs.com<\/span><\/strong>.”<\/p>\n

WHAT TO DO<\/h3>\n

Delete! Delete! Delete! And delete it from your trash folder so it is completely out of your computer system. Do not click on any of the links! It goes to some obscure address like “https:\/\/cdn-s.de\/cgi-bin\/index.php?xxxxxxx”\u00a0 (I do not post the\u00a0 whole link because someone might click on it from this post). It looks like this is a code that goes to your domain server’s coding folder where it will propagate serious damage.<\/p>\n

If you have time, please report the fake email (and all other suspicious email) to the Federal Trade Commission<\/a>. Help protect the rest of the world.<\/p>\n

This email was sent to my technical support address. So I assume it was meant to go to someone who had access to the inner workings of a website.<\/p>\n

Notice how the top line of the messages (supposedly quarantined) looks like it has something to do with a payment? Notice also how there are several links to “Release”? These are catchy words\/phrases to tempt you into seeing what you might be missing.<\/p>\n

 <\/p>\n

*********************<\/p>\n

Here is the rest of the actual message:<\/p>\n

\n
\n
\n

Dear Mail User [su*****<\/span>@***********<\/span>ng.com<\/span>]<\/span><\/p>\n

The links go here:<\/p>\n<\/div>\n<\/div>\n

\n
\n

Important<\/strong>: Some incoming messages have been placed in your Personal Quarantine.<\/p>\n

This pending messages will be deleted automatically after 7 days.<\/p>\n<\/div>\n<\/div>\n

\n
<\/div>\n<\/div>\n
\n
Few of your quarantined messages are listed below along with the actions that can be taken.<\/div>\n<\/div>\n
\n
To see all quarantined messages view\u00a0\u00a0\u00a0su*****<\/span>@***********<\/span>ng.com<\/span>” target=”_blank” rel=”noopener noreferrer”>your email quarantine<\/a>\u00a0and release to inbox<\/div>\n<\/div>\n
\n
\n\n\n\n\n\n\n\n\n\n
Quarantined email<\/b><\/th>\n<\/tr>\n
<\/th>\nRecipient:<\/th>\nSubject:<\/th>\ndate:<\/th>\n<\/tr>\n
Release<\/a><\/td>\n(su*****<\/span>@***********<\/span>ng.com<\/span>)<\/span><\/td>\nRemittance Payment\u00a0Advice For MT103<\/span><\/td>\n30\/04\/2020<\/td>\n<\/tr>\n
Release<\/a><\/td>\n(su*****<\/span>@***********<\/span>ng.com<\/span><\/span>)<\/td>\nRe: Re: Contract<\/td>\n30\/04\/2020<\/td>\n<\/tr>\n
Releas<\/a>e<\/td>\n(su*****<\/span>@***********<\/span>ng.com<\/span><\/span>)<\/td>\nRe: SALES ORDER CONFIRMATION<\/td>\n30\/04\/2020<\/td>\n<\/tr>\n
Releas<\/a>e<\/td>\n(su*****<\/span>@***********<\/span>ng.com<\/span><\/span>)<\/td>\nPayment Invoice N96A4456<\/td>\n30\/04\/2020<\/td>\n<\/tr>\n
Deliver all Messages<\/a><\/b><\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n
\n


\nNote\u00a0: This message was sent by the system for notification only.\u00a0\u00a0<\/span>\u00a0Please do not reply<\/p>\n

If this message lands in your spam folder, please move it to your inbox folder for proper interrogation:
\n<\/span><\/p>\n<\/div>\n

This mail is protected to [YOUR REAL ADDRESS]
\n\u24b8 2020 Cyber Security Alert . All Rights Reserved.<\/span><\/p>\n<\/div>\n

 <\/p>\n

***************<\/p>\n

 <\/p>\n

Here’s a variation of the same evil scheme:<\/p>\n

The links go to this Denmark server:
\nhttps:\/\/cdn-s.de<\/h3>\n

Subject: ITsupport Mail Quarantine Notification<\/h3>\n

Email Notification:<\/p>\n

Important<\/span><\/strong>:\u00a0 <\/span><\/span>Some incoming messages have been placed in your Personal Quarantine.
\nThis pending messages will be deleted automatically after 7 days.<\/p>\n

Deliver all mails to your Inbox: Visit your Webmail Quarantine Center<\/strong> – CLICK HERE<\/strong><\/a><\/p>\n

Few of your quarantined messages are listed below along with the actions that can be taken.<\/p>\n\n\n\n\n\n
Envelope From:<\/td>\nsa***<\/span>@**************<\/span>ng.com<\/span><\/a><\/td>\n<\/tr>\n
Subject:<\/td>\nInquiry<\/td>\n<\/tr>\n
Time:<\/td>\nMon, 04 May 2020 08:49:14 -0700<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n\n\n
Envelope From:<\/td>\nko**************<\/span>@*****<\/span>ok.com<\/span><\/a><\/td>\n<\/tr>\n
Subject:<\/td>\nRE: Order Confirmation<\/td>\n<\/tr>\n
Time:<\/td>\nMon, 04 May 2020 08:53:51 -0700<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n\n\n
Envelope From:<\/td>\nan**************<\/span>@*********<\/span>rk.com<\/span><\/a><\/td>\n<\/tr>\n
Subject:<\/td>\nL90GZ SN\/679577<\/td>\n<\/tr>\n
Time:<\/td>\nMon, 04 May 2020 08:55:24 -0700<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n\n\n\n
Deliver Messages to Inbox<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

****************
\nAnother Variation:<\/h2>\n

An email stating you purchased something and this was debited from your bank. The link goes to a fake website that appears to have no homepage but actually has a mischievous .ASPX file.<\/p>\n

Subject:\u00a0 Credit card purchase confirmation<\/strong><\/p>\n

\n
Hello<\/span><\/div>\n
<\/div>\n<\/div>\n
Find attached an ACH confirmation which was processed from your bank account.<\/span><\/div>\n
<\/div>\n
Invoice link<\/a><\/span><\/div>\n
<\/div>\n
Regards<\/div>\n","protected":false},"excerpt":{"rendered":"

Here’s another one of those fake emails. This one is relatively new in its approach. The Subject line says “WARNING!!! (4) Messages Quarantined” and it comes from “MAIL SERVER ad***@*****bs.com.” WHAT TO DO Delete! Delete! Delete! And delete it from your trash folder so it is completely out of your computer system. Do not click […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[18,30,20],"tags":[34],"class_list":["post-690","post","type-post","status-publish","format-standard","hentry","category-opinion","category-public-service","category-warning","tag-fake-mail-server-warning"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p61fMq-b8","_links":{"self":[{"href":"http:\/\/wynkmarketing.com\/wp-wynk\/wp-json\/wp\/v2\/posts\/690","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/wynkmarketing.com\/wp-wynk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/wynkmarketing.com\/wp-wynk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/wynkmarketing.com\/wp-wynk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/wynkmarketing.com\/wp-wynk\/wp-json\/wp\/v2\/comments?post=690"}],"version-history":[{"count":6,"href":"http:\/\/wynkmarketing.com\/wp-wynk\/wp-json\/wp\/v2\/posts\/690\/revisions"}],"predecessor-version":[{"id":697,"href":"http:\/\/wynkmarketing.com\/wp-wynk\/wp-json\/wp\/v2\/posts\/690\/revisions\/697"}],"wp:attachment":[{"href":"http:\/\/wynkmarketing.com\/wp-wynk\/wp-json\/wp\/v2\/media?parent=690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/wynkmarketing.com\/wp-wynk\/wp-json\/wp\/v2\/categories?post=690"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/wynkmarketing.com\/wp-wynk\/wp-json\/wp\/v2\/tags?post=690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}