There are also variants of it with subjects like " Ref Id: %VARIABLE% " and "%Domain.tld% Ref Id: %VARIABLE% " And as Bryan said, we are increasingly getting more and more as well. M. Omer GOLGELI --- AS202365 June 1, 2019 6:05 AM, "Richard" <rgolodner@infratection.com (mailto:rgolodner@infratection.com?to=%22Richard%22%20<rgolodner@infratection.com>)> wrote: On 5/31/19 8:07 PM, Niels Bakker wrote: * bryan@shout.net (mailto:bryan@shout.net) (Bryan Holloway) [Sat 01 Jun 2019, 01:54 CEST]:Anybody else noticed a significant uptick in these e-mails? When I first saw this thread, I hadn't seen any. A couple days later, I got my first one. (yay!) Now I'm getting 2-3 a day. (yay?) Yes. It's pretty annoying. And somebody seems to be burning through a lot of stolen credentials. I wonder what the success rate is... -- Niels. I am getting several a day as well as ugly MS Word based trojan. They come to me from all over the world with the subject line: "NANOG Payment Remittance Advice" I agree with Niels, someone or some spamming outfit is burning through quite a bit of stolen credentials. Richard Golodner Infratection