Date: Mon, 12 Dec 2011 10:36:39 +0100
From: "email@example.com" [firstname.lastname@example.org]
Subject: Better Business Bureau Case # 94181989
The Better Business Bureau has got the above-referenced complaint from one of your customers on the subject of their business relations with you.
The details of the consumer's concern are presented in enclosed document.
Please give attention to this issue and advise us of your point of view.
We encourage you to click here to respond this complaint.
We look forward to your urgent attention to this matter.
Better Business Bureau
Council of Better Business Bureaus
4200 Wilson Blvd, Suite 800
Arlington, VA 22203-1838
Phone: 1 (703) 276.0100
Fax: 1 (703) 525.8277
This link goes via a couple of legitimate hacked sites to a payload site at lazysit.net/main.php?page=abfd0d069b45c17e on 220.127.116.11. The IP address looks like it might be a legitimate but hacked server, blocking the IP address rather than the domain should block any other malicious sites on the same server.