Attack first started earlier in the week and has been sending the same set of emails everyday since 11/05/2018. I have upgraded my Spam protection and this is what I found. The SMTP there using is yahoo.jp _x000D_ Spoofed emails _x000D_ Aaron245Smith@yahoo.jp, 8FD02000.614BAFE9@yahoo.jp_x000D_ _x000D_ Received: from mmx09.tilkbans.com [74.159.16.39] by smtp.mixedthings.net with NNFMP; Thu, 08 Nov 2018 20:32:11 -0500_x000D_ Message-ID: <8FD02000.614BAFE9@yahoo.jp>_x000D_ Date: Thu, 08 Nov 2018 20:32:11 -0500_x000D_ Reply-To: Info <Aaron245Smith@yahoo.jp>_x000D_ _x000D_ X-Amavis-Alert: INFECTED, message contains virus: [C]_x000D_ Porcupine.Phishing.44681.UNOFFICIAL_x000D_ X-Spam-Flag: NO_x000D_ X-Spam-Score: 0_x000D_ X-Spam-Level:_x000D_ _x000D_ its the virus that stop it from passing through not the content in the email body.

Sent fake email for ransom.