Date: Thu, 25 Jan 2012 10:40:06 +0100
From: "firstname.lastname@example.org" [email@example.com]
Subject: Your pending ACH debit transfer
Dear Account Holder,
This message includes an important notice about the ACH debit transfer sent on your behalf, that was detained by our bank:
Transaction #: 766253676295142
Transaction status: pending
In order to resolve this matter, we prompt you to check the details of your transaction using the link below.
This follows the same pattern we have seen over the past few days. A Wepawet report for the malicious page is here. Blocking the IP address rather than the domain should block any other malicious sites on the server.
Update: chillepay.com is also being used in this spam run, hosted on 18.104.22.168 (also Linode)