From: Acacia@redacted.com [mailto:Acacia@redacted.com]
Sent: 26 October 2012 10:14
Subject: Your Photos
I have attached your photos to the mail (Open with Internet Explorer).
In this case there is an attachment called Image_DIG691233.htm that leads to a malware laden page at [donotclick]manekenppa.ru:8080/forum/links/column.php hosted on some familiar looking IPs:
188.8.131.52 (Interneto Vizija, Lithunia)
184.108.40.206 (MYREN, Malaysia)
220.127.116.11 (eNet, US)
We've seen these IPs before and they are well worth blocking.