Sponsored by..

Tuesday 19 March 2013

Facebook spam / heelicotper.ru

This fake Facebook spam leads to malware on heelicotper.ru:

Date:      Tue, 19 Mar 2013 08:37:37 +0200
From:      Facebook [updateSIXQG03I44AX@facebookmail.com]
Subject:      You have notifications pending

facebook
Hi,
Here's some activity you may have missed on Facebook.
TAMISHA Gore has posted statuses, photos and more on Facebook.
Go To Facebook
   
See All Notifications
This message was sent to [redacted]. If you don't want to receive these emails from Facebook in the future or have your email address used for friend suggestions, please click: unsubscribe.

Facebook, Inc. Attention: Department 415 P.O Box 10005 Palo Alto CA 94303
The malicious payload is at [donotclick]heelicotper.ru:8080/forum/links/column.php which isn't resolving at the moment, but was earlier hosted on:

50.22.0.2 (SoftLayer, US)
132.230.75.95 (Albert-Ludwigs-Universitaet, Germany)
188.165.202.204 (OVH, France)

The payload and associated IPs are the same as in this attack.

No comments: