Sponsored by..

Tuesday, 10 April 2012

Intuit.com spam / webmastaumuren.ru

Here's a fake Intuit spam leading to malware on webmastaumuren.ru:8080:

From: Yvonne Lewis [mailto:MalikDuenes@choice.net]
Sent: 10 April 2012 12:03
Subject: Dowload your Intuit.com invoice.

Dear customer: Thank you for ordering from Intuit Market. We are processing and will message you when your order ships. If you ordered multiple items, we may sned them in more than one delivery (at no extra cost to you) to ensure quicker delivery. If you have questions about your order please call 1-900-367-0794 ($4.49/min).

Please download your complete order id #4147367 from the attachment.(Open with Internet Explorer)

©2012 Intuit, Inc. All rights reserved. Intuit, the Intuit Logo, Quickbooks, Quicken and TurboTax, among others, are registered trademarks of Intuit Inc.

The malware is on webmastaumuren.ru:8080/navigator/jueoaritjuir.php (report here) which is multihomed on the same IP addresses found here.

No comments: