Date: Mon, 3 Dec 2012 11:34:38 +0330The malicious payload is at [donotclick]panamechkis.ru:8080/forum/links/column.php hosted on:
Subject: RE: Wire Transfer cancelled
Wire transfer was canceled.
FED NUMBER: 1704196955WIRE580676
Transaction Report: View
Federal Reserve Wire Network
18.104.22.168 (ULNetworks, Korea)
22.214.171.124 (GNet, Mongolia)
126.96.36.199 (MYREN, Malaysia)
Of these, 188.8.131.52 seems to be a new one which should be added to your blocklists.