Date: Mon, 14 Jan 2013 10:49:06 +0300The malicious payload is on [donotclick]dekamerionka.ru:8080/forum/links/column.php hosted on:
From: Friendster Games [email@example.com]
Subject: ADP Immediate Notification
ADP Immediate Notification
Reference #: 540328394
Mon, 14 Jan 2013 10:49:06 +0300
Dear ADP Client
Your Transfer Record(s) have been created at the web site:
Please see the following notes:
Please note that your bank account will be debited within one banking business day for the amount(s) shown on the report(s).
Please do not respond or reply to this automated e-mail. If you have any questions or comments, please Contact your ADP Benefits Specialist.
This note was sent to acting users in your system that approach ADP Netsecure.
As usual, thank you for choosing ADP as your business affiliate!
HR. Payroll. Benefits.
The ADP logo and ADP are registered trademarks of ADP, Inc.
In the business of your success is a service mark of ADP, Inc.
© 2013 ADP, Inc. All rights reserved.
18.104.22.168 (Master Internet s.r.o / Petr Bydzovsky, Czech Republic)
22.214.171.124 (Proservis UAB, Luthunia)
126.96.36.199 (ip4 GmbH, Germany)
Plain list of IPs and domains involved: