Date: Thu, 30 May 2013 16:06:12 +0000 [12:06:12 EDT]
From: Newegg [firstname.lastname@example.org]
Subject: Newegg.com - Payment Charged
My Account My Account | Customer Services Customer Services
Twitter Twitter You Tube You Tube Facebook Facebook Myspace Myspace
click to browse e-Blast click to browse Shell Shocker click to browse Daily Deals
Computer Hardware PCs & Laptops Electronics Home Theater Cameras Software Gaming Cell Phones Home & Office MarketPlace Outlet More
Customer ID: [redacted]
Account Number: 24577609
Thank you for shopping at Newegg.com.
We are happy to inform you that your order (Sales Order Number: 20781193) has been successfully charged to your�AMEX and order verification is now complete.
If you have any questions, please use our LiveChat function or visit our Contact Us Page.
Once You Know, You Newegg.
Your Newegg.com Customer Service Team
ONCE YOU KNOW, YOU NEWEGG. �
Newegg.com, 9997 Rose Hills Road, Whittier, CA. 90601-1701 | � 2000-2013 Newegg Inc. All rights reserved.
The malicious payload is any one of a number of domains hosted on 18.104.22.168 which is also being used in this attack. Blocking the IP is the easiest way to protect against the malicious sites hosted on that server.