Date: Thu, 14 Jun 2012 20:52:08 +0200
From: "UPS Quantum View" [firstname.lastname@example.org]
Subject: Track your UPS delivery online.
Discover more about UPS:
Sign Up For Additional E-Mail From UPS
Read Compass Online
This message was sent to you at the request of ICRealtime Security Solutions LLC to notify you that the electronic shipment information below has been transmitted to UPS. The physical package(s) may or may not have actually been tendered to UPS for shipment. To verify the actual transit status of your shipment, click on the tracking link below or contact ICRealtime Security Solutions LLC directly.
Important Delivery Information
Scheduled Delivery: 09-May-2012
2269 JEFFERIES HWY.
Number of Packages: 1
UPS Service: GROUND
Weight: 9.0 LBS
Tracking Number: 1ZX603R40369384687
Reference Number 1: 47479
Reference Number 2: 20872
Click here to track if UPS has received your shipment or visit
http://www.ups.com/WebTracking/track?loc=en_US on the Internet.
� 2012 United Parcel Service of America, Inc. UPS, the UPS brandmark, and the color brown are trademarks of United Parcel Service of America, Inc. All rights reserved.
Please do not reply directly to this e-mail. UPS will not receive any reply message.
For questions or comments, visit Contact UPS.
This communication contains proprietary information and may be confidential.� If you are not the intended recipient, the reading, copying, disclosure or other use of the contents of this e-mail is strictly prohibited and you are instructed to please delete this e-mail immediately.
Other subjects include:
Your UPS delivery tracking number.
Your UPS shipment tracking number.
The malicious payload is at [donotclick]savecoralz.net/main.php?page=2a709dab1e660eaf (report here) hosted on the following IPs:
126.96.36.199 (Swisscom, Switzerland)
188.8.131.52 (Interphone, Ukraine)
The domain autosnort.net is hosted on the same IPs and is probably also malicious.
Plain list for copy-and-pasting: