Wednesday, 17 October 2012 spam / and

This fake spam leads to malware on and

From: Amazon.Com []
Sent: 17 October 2012 06:54
Subject: Your order of "Bulova Men's 94B316 Precisionist Claremont Brown Leather Watch" has shipped!
Importance: High

Gift Cards
|     Your Orders

Shipping Confirmation
Order #272-3140048-4213404

Thank you for shopping with us. We thought you'd like to know that we shipped your gift, and that this completes your order. Your order is on its way, and can no longer be changed. If you need to return an item from this shipment or manage other orders, please visit Your Orders on

Your estimated delivery date is:
Tuesday, October 9, 2012

Your package is being shipped by UPS and the tracking number is 1ZX305712324670208. Depending on the ship speed you chose, it may take 24 hours for your tracking number to return any information.

Shipment Details

Bulova Men's 94B316 Precisionist Claremont Brown Leather Watch
Sold by LLC (     $109.95

Item Subtotal:     $109.95
Shipping & Handling:     $0.00
Total Before Tax:     $109.95
Shipment Total:     $109.95
Paid by Visa:     $109.95

Returns are easy. Visit our Online Return Center.
If you need further assistance with your order, please visit Customer Service.

We hope to see you again soon!

This email was sent from a notification-only address that cannot accept incoming email. Please do not reply to this message.
The malicious payload is at [donotclick] or [donotclick] hosted on (The First CJSC, Russia).

Added: and are also being used in this attack, although it they do not resolve at present.

Blocking and domains will probably not spoil your day. Blocking the range might not either.

Some other subjects seen:
Your order of "Citizen Men's BL2774-05L Eco-Drive Perpetual Calendar Chronograph Watch" has shipped!
Your order of "Casio Men's PAG165-0CR Pathfinder Triple Sensor Multi-Function Sport Watch" has shipped!
Your order of "G-Shock GA-386-1A8 Big Combi Military Series Watch" has shipped!
our order of "Fossil Men's FS2362 Black Silicone Bracelet Black Analog Dial Chronograph Watch" has shipped!
Your order of "Timex Ironman Men's Road Trainer Heart Rate Monitor Watch, Black/Orange, Full Size" has shipped!


ds said...

Any idea what the payload looks like?

byrsa said...

Payload for me was ZeroAccess (aka Sirefef).

ds said...