Date: Mon, 16 Jul 2012 18:10:26 +0000
From: "Intuit PaymentNetwork" [support@intuit.com]
Subject: You have received a new payment through the Intuit network.
Payment received: You received $280.00 from Henderson LLC for invoice 91816
You can access the payment details here.
Funds will be deposited in your bank account.
You now have the possibility to get paid by Credit Card on your invoices. To find put more please sign in to your IPN account and click on the 'Profile' tab on the left.
The malicious payload is at [donotclick]mailmergesfinger.org/main.php?page=bfc8be54a0120bca (report here) hosted on 94.249.172.71 (GHOSTnet, Germany).
The following IPs and domains are connected and should be avoided or blocked:
13.65.99.23
46.20.33.131
62.109.26.35
78.129.132.14
80.77.87.185
94.249.172.71
108.76.72.229
109.164.221.176
164.15.250.148
195.54.32.91
198.144.189.51
200.184.213.131
211.157.105.160
afriget.net
cms-wideopendns.com
fonografs.net
good-autosport.com
mailmergesfinger.org
peace-computer.com
proamd-inc.com
thaidescribed.com
No comments:
Post a Comment