{"id":398684,"date":"2026-08-02T04:07:00","date_gmt":"2026-08-02T04:07:00","guid":{"rendered":"https:\/\/malwaretips.com\/blogs\/?p=398684"},"modified":"2026-08-02T04:07:00","modified_gmt":"2026-08-02T04:07:00","slug":"finance-department-secure-file-email-scam-how-a-fake-pdf-steals-your-login","status":"publish","type":"post","link":"https:\/\/malwaretips.com\/blogs\/finance-department-secure-file-email-scam-how-a-fake-pdf-steals-your-login\/","title":{"rendered":"Finance Department Secure File Email Scam: How a Fake PDF Steals Your Login"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A file marked as approved by the General Manager can feel too important to ignore. This email exploits that workplace reflex with a fake Finance Department notification and a document button that leads outside the organization.<\/p><div id=\"mwtad2781715503\" class=\"gas_fallback-ad_309684--placement_360520\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3957935887\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The supposed PDF is not the real objective. The linked page imitates a webmail sign-in screen and steals the credentials employees enter before they can view the document.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1536\" height=\"1024\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/finance-department-secure-file-scam.png\" alt=\"Fake Finance Department secure-file email and phishing login page\" class=\"wp-image-398679\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/finance-department-secure-file-scam.png 1536w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/finance-department-secure-file-scam-300x200.png 300w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/finance-department-secure-file-scam-1024x683.png 1024w\" sizes=\"(max-width: 1536px) 100vw, 1536px\" \/><figcaption class=\"wp-element-caption\">The campaign disguises an external phishing link as an internal Finance Department document share.<\/figcaption><\/figure>\n\n\n\n<div id=\"mwtad1570039561\" class=\"gas_fallback-ad_309746-ad_309691-placement_360521\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"4456629336\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Overview<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Finance Department (General Manager) Secure File email scam is a business-themed phishing attack. It claims that a senior manager or finance team has shared a protected PDF with the recipient, creating both authority and curiosity.<\/p><div id=\"mwtad3945542806\" class=\"gas_fallback-ad_381396-ad_309691-placement_360566\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"1471373341\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The message may use the subject <strong>File has been shared with you &#8211; Finance from GM.<\/strong> Its body says that a secured file was shared by the Finance Department and presents <strong>Document_Approved_File.pdf<\/strong> as a <strong>94.40 KB<\/strong> document.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The visible <strong>Open Document<\/strong> button is not a safe PDF attachment. It leads to an external phishing page hosted on a domain unrelated to the recipient&#8217;s employer or email provider. The campaign has used <strong>overall-brown-uwcc7fcx.edgeone[.]dev<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That page asks the victim to sign in to webmail. It can display familiar styling associated with popular email services, often chosen according to the recipient&#8217;s address. The branding is camouflage; the form sends the password to criminals.<\/p><div id=\"mwtad2958284720\" class=\"gas_fallback-ad_309686-ad_309691-placement_360569\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"6935453015\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The scam may even advise the recipient to contact a system administrator if there is a problem. That line is there to sound security-conscious. A genuine safety message inside the same email does not validate the external link.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Impersonates an internal Finance Department and General Manager<\/li><li>Uses a fake PDF named <strong>Document_Approved_File.pdf<\/strong><\/li><li>Displays a precise file size to imitate a real sharing service<\/li><li>Routes the recipient to an unrelated external domain<\/li><li>Collects email credentials through a counterfeit sign-in form<\/li><\/ul>\n\n\n\n<div id=\"mwtad3033342480\" class=\"gas_fallback-ad_309747-ad_309691-placement_360587\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"9589536513\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Is the Finance Department Secure File Email Legitimate?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">No. This message is a confirmed credential-phishing scam. It is not a legitimate file notification from the recipient&#8217;s finance team, General Manager or email provider.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If your organization really shares sensitive finance documents, open the approved company portal directly or ask the sender through a known internal channel. Do not verify the request by replying to the suspicious message.<\/p><div id=\"mwtad3996580570\" class=\"gas_fallback-ad_381401-ad_309691-placement_360573\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"5315249587\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<div id=\"mwtad2649950824\" class=\"gas_fallback-ad_309748-ad_309691-placement_360588\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3906789406\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">How the Finance Department Secure File Scam Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: The attacker impersonates an authority figure<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The mention of a General Manager makes the request feel important and discourages delay. Employees may fear appearing unresponsive to senior management.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: The message presents a protected finance document<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The filename and small file-size label make the notification resemble a familiar cloud-sharing service. The recipient expects a PDF, not an account-security decision.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Open Document sends the victim elsewhere<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The button hides the real destination. Instead of opening an internal file portal, it directs the browser to an unrelated domain controlled or abused by the phishing campaign.<\/p><div id=\"mwtad1974541034\" class=\"gas_fallback-ad_381404-ad_309691-placement_381406\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"8735619847\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: The fake portal requests webmail credentials<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The page may already know the recipient&#8217;s email address and may adapt its appearance. This personalization can be persuasive, but it does not prove that the page belongs to the employer or email provider.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: The password is transmitted to the attacker<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">After the victim clicks Sign In, the credentials are captured. The site may claim the password was incorrect, ask for it twice or redirect to a harmless page to reduce suspicion.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: The compromised mailbox is abused<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Attackers can search for invoices, payroll files, customer data and reset emails. They may monitor conversations, create hidden forwarding rules or send new phishing messages that appear to come from a trusted coworker.<\/p><div id=\"mwtad232186529\" class=\"gas_fallback-ad_360582-ad_309691-placement_360581\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"9971336976\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<div id=\"mwtad2515429670\" class=\"gas_fallback-ad_318930-ad_309691-placement_360589\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3818335085\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Red Flags in the Fake File Notification<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>You were not expecting a finance document from the General Manager<\/li><li>The sender address does not use the organization&#8217;s exact mail domain<\/li><li>The wording is generic and does not explain what the document concerns<\/li><li>The Open Document link points to an external domain such as edgeone.dev<\/li><li>The page asks for your mailbox password rather than using the company&#8217;s normal single sign-on flow<\/li><li>The message uses authority and secrecy to discourage normal verification<\/li><\/ul>\n\n\n\n<div id=\"mwtad1894869443\" class=\"gas_fallback-ad_381388-ad_309691-placement_381390\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3191649120\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Why the Fake PDF Name Is Effective<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PDFs are common in finance, and employees rarely consider a filename dangerous when no attachment is visibly downloaded. The scam uses the document name as a label for a link, allowing the phishing page to sit one click away.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The word <strong>Approved<\/strong> is also deliberate. It suggests that someone senior has already reviewed the content, so the recipient may feel there is less need to question it.<\/p>\n\n\n\n<div id=\"mwtad4244710876\" class=\"gas_fallback-ad_381392-ad_309691-placement_381395\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"2944237110\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">What to Do If You Received the Email<\/h2>\n\n\n\n<ol class=\"wp-block-list\"><li>Do not click Open Document<\/li><li>Check the destination by hovering over the button without opening it<\/li><li>Ask the General Manager or Finance Department through Teams, phone or a known internal address<\/li><li>Open your organization&#8217;s file portal from a saved bookmark instead of the email<\/li><li>Report the message to your security team and then delete it<\/li><\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">What to Do If You Clicked the Link<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">If you only viewed the page<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Close it and report the email. Do not download any file offered by the site. Clear the site&#8217;s cookies and run a security scan if the page triggered a download, extension prompt or unusual browser behavior.<\/p><div id=\"mwtad2109884204\" class=\"gas_fallback-ad_360567-ad_309691-placement_360771\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"6224621518\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\">If you entered your password<\/h3>\n\n\n\n<ol class=\"wp-block-list\"><li>Change the email password immediately from a clean device<\/li><li>Revoke active sessions and unfamiliar app passwords or OAuth connections<\/li><li>Enable multi-factor authentication, preferably with an authenticator or security key<\/li><li>Review recovery addresses, phone numbers and inbox forwarding rules<\/li><li>Check sent, deleted and archived folders for messages you did not create<\/li><li>Notify IT so the domain, sender and sessions can be investigated<\/li><li>Warn coworkers if messages were sent from your account<\/li><\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">If you downloaded a file<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Do not open it. Delete it after your security team has collected anything needed for analysis, and run a full malware scan. If you already opened an unexpected executable or enabled active content, disconnect the device and seek immediate technical help.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Organizations Can Reduce This Risk<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>Use a clearly branded, consistent platform for internal file sharing<\/li><li>Add external-sender banners to messages arriving from outside the organization<\/li><li>Block newly registered and low-reputation domains at the email gateway<\/li><li>Require phishing-resistant multi-factor authentication<\/li><li>Teach employees to verify unusual requests from executives through a second channel<\/li><li>Alert on newly created mailbox forwarding rules and impossible-travel sign-ins<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently Asked Questions<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Is Document_Approved_File.pdf itself attached?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The campaign presents it as a shared document, but the button leads to a phishing page. The filename is part of the disguise.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Is edgeone.dev an internal company portal?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. A domain like <strong>overall-brown-uwcc7fcx.edgeone[.]dev<\/strong> does not match a normal corporate or email-provider login. Never enter work credentials there.<\/p><div id=\"mwtad290041601\" class=\"gas_fallback-ad_360571-ad_309691-placement_360772\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"5867729999\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Can multi-factor authentication still help after a password is stolen?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes, but act quickly. Change the password, revoke sessions and confirm that no new authentication method, app password or forwarding rule was added.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Bottom Line<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Finance Department secure-file email is a confirmed phishing attack. Its fake PDF and General Manager language are designed to make an external login request feel like routine internal work.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not sign in through the message. Verify the request with the supposed sender, open company systems directly and treat any password entered on the linked page as compromised.<\/p><div id=\"mwtad1284508686\" class=\"gas_fallback-ad_360576-ad_309691-placement_360773\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"6594472392\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>A fake Finance Department file-share email uses Document_Approved_File.pdf to send employees to a counterfeit webmail login.<\/p>\n","protected":false},"author":50,"featured_media":398679,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ai_generated_summary":"","footnotes":""},"categories":[49,2839,2842],"tags":[],"class_list":["post-398684","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scam-reports","category-scam-emails","category-impersonation-scams","masonry-post","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/398684","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/users\/50"}],"replies":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/comments?post=398684"}],"version-history":[{"count":1,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/398684\/revisions"}],"predecessor-version":[{"id":398689,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/398684\/revisions\/398689"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media\/398679"}],"wp:attachment":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media?parent=398684"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/categories?post=398684"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/tags?post=398684"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}