For some reason the only sample of the spam that I have is horribly mangled:
From: HamzaRowson@hotmail.com [mailto:HamzaRowson@hotmail.com]
Sent: 19 March 2013 23:40
Subject: United Postal Service Tracking Number H1338091657
Your USPS TEAM for big savings! Can't see images? CLICK HERE. UPS UPS SUPPORT 56 Not Ready to Open an Account? The UPS Store® can help with full service packing and shipping.Learn More >> UPS - Your UPS Team Good day, [redacted].
Dear User , Delivery Confirmation: Failed
Track your Shipment now!
Clicking on the attachment sends the intended victim to a malicious web page at [donotclick]himalayaori.ru:8080/forum/links/column.php (report here), in this case via a legitimate hacked site at [donotlick]www.unisgolf.ch/report.htm but that is less important.
himalayaori.ru is hosted on a couple of IPs that look familiar:
126.96.36.199 (SoftLayer, US)
188.8.131.52 (OVH, France)