Date: Wed, 5 Dec 2012 11:32:47 +0330
From: Bebo Service [email@example.com]
Subject: Urgent information from BBB
Here with the Better Business Bureau notifies you that we have received a complaint (ID 243917811)
from one of your customers with respect to their dealership with you.
Please open the COMPLAINT REPORT below to obtain more information on this matter and let us know of your point of view as soon as possible.
We are looking forward to your prompt reply.
The malicious payload is at [donotclick]leberiasun.ru:8080/forum/links/column.php (report here) hosted on the following IPs:
188.8.131.52 (Aliyun Computing Co, China)
184.108.40.206 (GNet, Mongolia)
220.127.116.11 (Psychz Networks, US)
18.104.22.168 (SK Broadband, Korea
These IPs have been used in several attacks recently. You should block access if you can.