Date: Tue, 12 Feb 2013 09:11:11 +0200The malicious payload is at [donotclick]emaianem.ru:8080/forum/links/column.php and is hosted on the same servers as found here.
From: LinkedIn Password [email@example.com]
Subject: Re: Changlog 10.2011
changelog update - View
Date: Tue, 12 Feb 2013 05:14:54 -0600
From: LinkedIn [firstname.lastname@example.org]
Subject: Fwd: Re: Changelog as promised(updated)
as prmised updated changelog - View