Date: Tue, 2 Apr 2013 03:57:26 +0000
From: "JOSIE HARMON" [HARMON_JOSIE@hotmail.com]
Subject: You have been sent a file (Filename: [redacted]-7191.pdf)
Sendspace File Delivery Notification:
You've got a file called [redacted]-463168.pdf, (172.5 KB) waiting to be downloaded at sendspace.(It was sent by JOSIE HARMON).
You can use the following link to retrieve your file:
Download Link
The file may be available for a limited time only.
Thank you,
sendspace - The best free file sharing service.
----------------------------------------------------------------------
Please do not reply to this email. This auto-mailbox is not monitored and you will not receive a response.
The malicious payload is at [donotclick]imbrigilia.ru:8080/forum/links/column.php (report here) hosted on the same IPs used in this attack:
80.246.62.143 (Alfahosting GmbH, Germany)
94.103.45.34 (ANKARAHOSTING, Turkey)
Blocklist:
80.246.62.143
94.103.45.34
humaniopa.ru
hiskinta.ru
illuminataf.ru
izamalok.ru
ilianorkin.ru
hillaryklinton.ru
izjianokr.ru
ivanovoposel.ru
hohohomaza.ru
imbrigilia.ru
No comments:
Post a Comment