Date: Thu, 28 Mar 2013 04:58:33 +0600 [03/27/13 18:58:33 EDT]The malicious payload is at [donotclick]ipiniadto.ru:8080/forum/links/column.php (report here) hosted on the same IPs as used in this attack:
From: FilesTube [firstname.lastname@example.org]
Subject: You have notifications pending
Here's some activity you may have missed on Facebook.
BERTIE Goldstein has posted statuses, photos and more on Facebook.
Go To Facebook
See All Notifications
This message was sent to [redacted]. If you don't want to receive these emails from Facebook in the future or have your email address used for friend suggestions, please click: unsubscribe.
Facebook, Inc. Attention: Department 415 P.O Box 10005 Palo Alto CA 94303
18.104.22.168 (Endurance International Group, US)
22.214.171.124 (RapidDSL & Wireless, US)
126.96.36.199 (TANET, Taiwan)