Date: Fri, 9 Dec 2011 13:28:41 -0300
From: "The Electronic Payments Association"
Subject: ACH transaction rejected
The ACH transaction (ID: 870526083755), recently initiated from your checking account (by you or any other person), was canceled by the Electronic Payments Association.
Transaction ID: 870526083755
Reason of rejection See details in the report below
Transaction Report report_870526083755.doc (Microsoft Word Document)
13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100
© 2011 NACHA - The Electronic Payments Association
The malicious payload is on wonderfulwrench.com/main.php?page=977334ca118fcb8c on 18.104.22.168 (Safya Net, Turkey). We saw the same IP range yesterday, so I recommend blocking access to 22.214.171.124/24 at the least, or 126.96.36.199/21 if you want to be a bit more aggressive in your filtering.