09/27/2017 Subject: Pending Message

From: Support <agarcia@cbtulsa.com>  —> Not a Wesleyan address Date: Wednesday, September 27, 2017 at 8:42 AM To: “noreply@office365.com” <noreply@office365.com> Subject: Pending Message You have 5 new Pending Message to retrieve during our last email outages RETRIEVE —> address actually, goes to hxxr://members.westnet.com.ax7/~oooo365/o/three.html Sincerely Mail PostMaster —> Not a legitimate Wesleyan Signature

09/21/2917 Subject: Invoice number 647003812 Notification

Sent: Wednesday, September 20, 2017 8:20 PM To: xxxxx, xxxxx Subject: Invoice number 647003812 Notification Dear Client, Here is your invoice dated 21 Sep 17. Give me a phone call at 01322 444908, if you have any questions regarding this invoice. See Invoice Below: hxxpr://ladymicki.cox/Invoice-Dated-21-Sep-17-12787148683/SGYO-JQB/2017/ –> This address will install malware on your system.  Thank you!

09/19/2017 Subject: important

From: “Wesleyan Universityr” <mhaarnold@wesleyan.edu> Date: Tue, Sep 19, 2017 at 9:52 AM -0400 Subject: important To: “Xxxxx, Xxxxx” <xxxxx@wesleyan.edu>    Dear xxxxx@wesleyan.edu, You are required to update your account. CLICK HERE Security Service Wesleyan University The originating address looks legitimate. However, if you try to look them up in the address book they do not … Read more09/19/2017 Subject: important

09/12/2017 Subject: You have (1) new Message

From: Wesleyan University <xw322@drexel.edu> Subject: You have (1) new Message Date: September 12, 2017 at 8:37:41 PM EDT To: Recipients <xw322@drexel.edu> Dear User, You have (1) new Security Mail. Kindly CLICK HERE to read now. Wesleyan University   The “From” address is not a valid Wesleyan address. The link takes you to a totally invalid … Read more09/12/2017 Subject: You have (1) new Message

09/11/2017 Subject: Library Notifications

From: “Wesleyan University Library” <libraries@wesleyan.com> –>Convincing looking “From” address. Date: Sep 11, 2017 5:08 PM Subject: Library Notifications To: a wesleyan person Cc: Dear Student, This is to inform you that your access to Wesleyan University Library Databases will expire soon. Due to security precautions established to protect Wesleyan University Libraries System, you have to renew your … Read more09/11/2017 Subject: Library Notifications


The “Wesleyan University” address is actually, ryry@coultercomm.com.  Not a Wesleyan Address. The “CLICK HERE“ is a downloadable malware package. It is not a web Redirect and you will be infected. There is no signature or specific contact person identified.

09/08/2017 Subject: Message From Administrator

From: Director Bobzien [mailto:BODBobzien@reston.org] Sent: Friday, September 08, 2017 11:04 AM Subject: Message From Administrator   your Webmail Account need verification Immediately. Please Verify now to Keep email Account active.   ——–>the shortcut in BLUE actually, goes to hxxp://tyjuanmsta.bplaced.net/bloog/upd/int/sys/12XY. The original message text is actually, red.