Sponsored by..

Tuesday, 27 November 2012

Wire transfer spam / gurmanikia.ru

This fake wire transfer spam leads to malware on gurmanikia.ru:

Date:      Tue, 27 Nov 2012 01:14:15 -0500
From:      Emerita Ayers via LinkedIn [member@linkedin.com]
Subject:      RE: Your Wire Transfer N27172774

Dear Customers,

Wire debit transfer was canceled.

Canceled transfer:

FED NUMBER: 6946432301WIRE298280

Transaction Report: View

Federal Reserve Wire Network
The malicious payload is at [donotclick]gurmanikia.ru:8080/forum/links/column.php hosted on the following well-known malicious IPs: (GNet, Mongolia) (MYREN, Malaysia) (Psychz Networks, US)

No comments: