There are also variants of it with subjects like

" Ref Id: %VARIABLE% "
and
"%Domain.tld% Ref Id: %VARIABLE% "



And as Bryan said, we are increasingly getting more and more as well.




M. Omer GOLGELI
---
AS202365




June 1, 2019 6:05 AM, "Richard" <rgolodner@infratection.com> wrote:
On 5/31/19 8:07 PM, Niels Bakker wrote:
* bryan@shout.net (Bryan Holloway) [Sat 01 Jun 2019, 01:54 CEST]:
Anybody else noticed a significant uptick in these e-mails?

When I first saw this thread, I hadn't seen any. A couple days later, I got my first one. (yay!) Now I'm getting 2-3 a day. (yay?)

Yes. It's pretty annoying. And somebody seems to be burning through a lot of stolen credentials. I wonder what the success rate is...


-- Niels.

I am getting several a day as well as ugly MS Word based trojan.

They come to me from all over the world with the subject line:

"NANOG Payment Remittance Advice"

I agree with Niels, someone or some spamming outfit is burning

through quite a bit of stolen credentials.

Richard Golodner

Infratection