Sponsored by..

Tuesday 23 October 2012

Intuit spam / montrealhotpropertyguide.com

This fake Intuit spam leads to malware on montrealhotpropertyguide.com:


Date:      Tue, 23 Oct 2012 14:45:14 +0200
From:      "Intuit QuickBooks Customer Service" [35378B458@aubergedesbichonnieres.com]
Subject:      Intuit QuickBooks Order


   
Dear [redacted],



Thank you for placing an order with Intuit QuickBooks!

We have received your payment information and it is currently being processed.
   
   
    ORDER INFORMATION    
       
Order #:    366948851674
Order Date:    Oct 22, 2012

[ View order ]

Qty     Item     Price
1     Intuit QuickBooks Pro Download 2 2012     $183.96***

   
Subtotal:
Sales Tax:
Total for this Order:
   
$183.96
$0.00
$183.96
*Appropriate credit will be applied to your account.



Please Note: Sales tax calculations are estimated. The final sales tax calculation will comply with local regulations.

       
    NEED HELP?    
       

Questions about your order? Please visit Customer Service.

       
       
           
Join Us On Facebook
           
           
           
           
Close More Sales
           

           
           
Save Time
           
           
           
   


Privacy | Legal | Contact Us | About Intuit

You have received this business communication as part of our efforts to fulfill your request or service your account. You may receive this and other business communications from us even if you have opted out of marketing messages.



If you receive an email message that appears to come from Intuit but that you suspect is a phishing email, please forward it immediately to spoof@intuit.com. Please visit http://security.intuit.com/ for additional security information.



Please note: This email was sent from an auto-notification system that cannot accept incoming email. Please do not reply to this message.



� 2012 Intuit Inc. or its affiliates. All rights reserved.

The malicious payload is on [donotclick]montrealhotpropertyguide.com/links/showed-clearest-about.php hosted on 64.111.26.15 (Data 102, US).

2 comments:

Safi said...

Thanks a million for this blog post. I realize that I'm not alone! Thanks again bro :)

James Lam said...

I got one just like that today... click on the link and It took me to http://ser.foryourcatonly.com/chrome/