There are also variants of it with subjects like
" Ref Id: %VARIABLE% "
and
"%Domain.tld% Ref Id: %VARIABLE% "
And as Bryan said, we are increasingly getting more and more as well.
M. Omer GOLGELI
---
AS202365
June 1, 2019 6:05 AM, "Richard" <rgolod...@infratection.com
(mailto:rgolod...@infratection.com?to=%22Richard%22%20<rgolod...@infratection.com>)>
wrote:
On 5/31/19 8:07 PM, Niels Bakker wrote: * br...@shout.net
(mailto:br...@shout.net) (Bryan Holloway) [Sat 01 Jun 2019, 01:54 CEST]:Anybody
else noticed a significant uptick in these e-mails?
When I first saw this thread, I hadn't seen any. A couple days later, I got my
first one. (yay!) Now I'm getting 2-3 a day. (yay?)
Yes. It's pretty annoying. And somebody seems to be burning through a lot of
stolen credentials. I wonder what the success rate is...
-- Niels.
I am getting several a day as well as ugly MS Word based trojan.
They come to me from all over the world with the subject line:
"NANOG Payment Remittance Advice"
I agree with Niels, someone or some spamming outfit is burning
through quite a bit of stolen credentials.
Richard Golodner
Infratection
