Monday, 19 November 2012

"Southwest Airlines" spam / headerandfooterprebuilt.pro

This fake Southwest Airlines spam leads to malware at headerandfooterprebuilt.pro:

Date:      Mon, 19 Nov 2012 19:33:04 +0000
From:      "Southwest Airlines" [no-reply@luv.southwest.com]
To:      [redacted]
Subject:      Southwest Airlines Confirmation: 5927NI

[redacted] 2012-11-19 86KY9Z INITIAL SLC WN PHX0.00T/TFF 0.00 END AY3.50$SLC2.50 1445164773311 2013-11-22 1655 2012-11-20 Depart SAN LEONARD CITY UT (SLC) at 8:08 PM on Southwest Airlines Arrive in PHOENIX AZ (PHX) at 9:02 PM

You're all set for your traveling!
   
   
My Account | Review My Itinerary Online

   
Check Up Online | Check Flight Status | Change Flight | Special Offers | Hotel Deals | Car Deals
   
Ready for lift-off!
   
Thanks Southwest for your travel! You can find everything you need to know about your booking below. Happy voyage!
Upcoming Cruise: 11/20/12 - SLC - Phx Knight 

The malicious payload is at [donotclick]headerandfooterprebuilt.pro/detects/quality_flyes-ticket_check.php hosted on 198.27.94.80 (OVH, US). There are probably other Bad Things on that IP address, I just can't see them yet.. blocking it would be a good precaution.

2 comments:

Wendylu said...

I just got it too, thanks for the warning.

Ed Ruiz said...

got it too, I thought it was a mistake or something, I'm not even in the US.