AICPA spam / jeffknitwear.org

I haven't seen this fake AICPA spam for a while, but here it is.. this time leading to a malicious payload on the domain jeffknitwear.org:

Date:      Thu, 19 Jul 2012 17:03:06 +0300
From:      "Lakisha Rush" [support@aicpa.org]
Subject:      Termination of your accountant license.

You're receiving this notification as a Certified Public Accountant and a member of AICPA.
Having trouble reading this email? View it in your browser.

Cancellation of Accountant status due to income tax fraud allegations

Dear AICPA member,

We have received a complaint about your possible participation in income tax refund fraudulent activity for one of your clients. According to AICPA Bylaw Paragraph 730 your Certified Public Accountant license can be withdrawn in case of the fact of filing of a misguided or fraudulent tax return for your client or employer.

Please be informed of the complaint below and respond to it within 7 days. The failure to respond within this term will result in cancellation of your CPA license.

Complaint.pdf

The American Institute of Certified Public Accountants.

Email: service@aicpa.org
Tel. 888.777.7077
Fax. 800.362.5066

==========

Date:      Thu, 19 Jul 2012 14:02:48 +0000
From:      "Jonathan Gallagher" [support@aicpa.org]
Subject:      Fraudulent tax return assistance accusations.

You're receiving this email as a Certified Public Accountant and a member of AICPA.
Having trouble reading this email? View it in your browser.

Cancellation of Accountant status due to income tax fraud allegations

Dear accountant officer,

We have been notified of your possible involvement in tax return fraudulent activity for one of your employees. According to AICPA Bylaw Paragraph 730 your Certified Public Accountant license can be cancelled in case of the occurrence of presenting of a misguided or fraudulent income tax return on the member's or a client's behalf.

Please familiarize yourself with the notification below and respond to it within 14 days. The failure to provide the clarifications within this time-frame will result in termination of your Accountant status.

Complaint.pdf

The American Institute of Certified Public Accountants.

Email: service@aicpa.org
Tel. 888.777.7077
Fax. 800.362.5066

The malicious payload is at [donotclick]jeffknitwear.org/main.php?page=8614d3f3a69b5162 (report here) hosted on 221.131.129.200 (China Mobile, China). The following domains are on the same server and you should either block the IP or these domains too:

checkingservices.net
historyalmostany.org
jeffknitwear.org
lefttorightproductservice.org
toeplunge.org
yourfirstwall.com
visorwordprocessor.org