Date: Mon, 28 Jan 2013 17:30:50 +0100
From: "Facebook" [email@example.com]
Subject: Most recent events on Facebook
You have disabled your Facebook account. You can reveal your account whenever you wish by logging into Facebook with your old login email address and password. After that you will be able to enjoy the site in the same way as before.
The Facebook Team
Log in to Facebook and start connecting
Please use the link below to resume your account :
This message was sent to [redacted]. If you don't want to receive these emails from Facebook in the future, please click: unsubscribe.
Facebook, Inc. Attention: Department 419 P.O Box 10007 Palo Alto CA 94301
The malicious payload is at [donotclick]gonita.net/detects/sign_on_to_resume.php (report here) hosted on the well-known IP of 126.96.36.199 (Hanaro Telecom, Korea).
The following malicious domains are active on the same IP: