Sponsored by..

Friday, 22 February 2013

"Data Processing" spam / dekolink.net

This fake "Data Processing" spam leads to malware on dekolink.net:


Date:      Fri, 22 Feb 2013 08:06:43 -0500
From:      "Data Processing Service" [customersupport@dataprocessingservice.com]
Subject:      ACH file ID '768.579

Files Processing Service

SUCCESS Note
We have successfully handled ACH file 'ACH2013-02-20-5.txt' (id '768.579') submitted by user '[redacted]' on '2013-02-20 1:14:30.7'.
FILE SUMMARY:

Item count: 79

Total debits: $28,544.53

Total credits: $28,544.53

For more info click here

The malicious payload is at [donotclick]dekolink.net/detects/when-weird-contrast.php (report here) hosted on the following servers:

50.7.251.59 (FDC Servers, Czech Republic)
176.120.38.238 (Langate, Ukraine)

2 comments:

Cécile GRIEU said...
This comment has been removed by the author.
Unknown said...

I just got this email today. I knew it was some kind of spam, but it's nice to have confirmation. Thanks for your post.