Date: Wed, 7 Mar 2012 -06:40:22 -0800
From: "FANNY Baez"
Subject: Better Business Bureau Complaint
Here with the Better Business Bureau would like to inform you that we have received a complaint (ID 323259211) from a customer of yours in regard to their dealership with you.
Please open the COMPLAINT REPORT attached to this email (open with Internet Explorer/Firefox)
to view the details on this issue and suggest us about your position as soon as possible.
We hope to hear from you shortly.
Better Business Bureau
The payload site is at cjhsdvbfbczuet.ru:8080/images/aublbzdni.php but at the moment it doesn't seem to be resolving so there are no IPs to block. However, monitoring your logs for .ru:8080 from time-to-time could help detect users who have clicked through.