I can approve this from our findings (author of this research): our system lists around 100 instances of the pattern you've mentioned every week, and around %3 are malicious. It would be great seeing it coming to an end.