Date: Tue, 7 Aug 2012 16:34:21 +0200The malicious payload is at [donotclick]remindingwands.org/main.php?page=861097b084221fd although at the moment it is not responding. This site is hosted on 126.96.36.199 (CYTA, Greece) which is a particularly evil IP that has been seen a lot of lately and can safely be blocked.
From: "123Greetings.com" [firstname.lastname@example.org]
Subject: New e-card for you.
Vanna email@example.com has just sent you an ecard from 123Greetings.com
You can view it by clicking here:
Thanks to our new tracking feature, you can now access all the ecards received by you in the last 14 days.
Use the link below or copy & paste the link into your browser's address bar.
Or if you prefer you can go to http://www.123greetings.com/ and type your ecard number (0090593007) in the "Search Box" at the top right of the page.
Your ecard can be downloaded for the next 30 days.
Based on user feedback, 123Greetings.com has launched 6 new pages with the best ecards in the Most Popular/ Most Viewed/ Highest Rated/ Latest Additions/ Popular Now and Always There Sections listed on the homepage.
If you need any help in viewing your ecard or any other assistance,
please visit our Help/ FAQ section at: http://help.123greetings.com/
We hope you enjoy your ecard,
Your friends at 123Greetings.com
We respect your privacy. You will not be receiving any promotional emails from us
Note: This is an auto generated mail. Please do not reply.
If you have any other problem please contact us by clicking on the following link:
This email was sent by 123Greetings.com, Inc., 1674 Broadway, New York, NY 10019.