Date: Thu, 15 Dec 2011 11:52:56 +0700
From: Facebook [notification+VGNDUO7NQM4R@facebookmail.com]
Subject: LUCY Snow wants to be friends on Facebook.
LUCY Snow wants to be friends with you on Facebook.
Confirm Friend Request
See All Requests
This message was sent to email@example.com. If you don't want to receive these emails from Facebook in the future or have your email address used for friend suggestions, please click: unsubscribe.
Facebook, Inc. Attention: Department 415 P.O Box 10005 Palo Alto CA 94303
In this case, the link goes via a hacked legitimate site and gets redirected to a malicious page on caredret.ru/main.php hosted on 220.127.116.11 (Digital Network JSC, Russia aka DINETHOSTING). Block access to 18.104.22.168/20 if you can, there is nothing legitimate hosted here.