Date: Thu, 13 Dec 2012 09:08:32 -0400The malicious payload is at [donotclick]awoeionfpop.ru:8080/forum/links/column.php hosted on the following IPs that I haven't seen before:
From: "Myspace" [email@example.com]
Subject: Fwd: Deshaun - Copies of Policies
Unfortunately, I cannot obtain electronic copies of the SPII policy.
Here is the Package and Umbrella,
and a copy of the most recent schedule.
126.96.36.199 (Comcast Business, US)
188.8.131.52 (Axarnet, Spain)
The following domains are also on these IPs: