123Greetings.com spam / remindingwands.org

This fake 123Greetings.com spam actually delivers malware instead, hosted on remindingwands.org:

Date:      Tue, 7 Aug 2012 16:34:21 +0200
From:      "123Greetings.com" [ecards@123greetings.com]
Subject:      New e-card for you.

Vanna amet.diam.eu@lorem.ca has just sent you an ecard from 123Greetings.com

You can view it by clicking here:
http://www.123greetings.com/send/view/999095:

Thanks to our new tracking feature, you can now access all the ecards received by you in the last 14 days.

Use the link below or copy & paste the link into your browser's address bar.
http://www.123greetings.com/connect/track

Or if you prefer you can go to http://www.123greetings.com/ and type your ecard number (0090593007) in the "Search Box" at the top right of the page.

Your ecard can be downloaded for the next 30 days.

Based on user feedback, 123Greetings.com has launched 6 new pages with the best ecards in the Most Popular/ Most Viewed/ Highest Rated/ Latest Additions/ Popular Now and Always There Sections listed on the homepage.

http://www.123greetings.com/top/most_popular.html
http://www.123greetings.com/top/most_viewed.html
http://www.123greetings.com/top/highest_rated.html
http://www.123greetings.com/top/latest.html
http://www.123greetings.com/top/popular_now.html
http://www.123greetings.com/top/always_there.html

If you need any help in viewing your ecard or any other assistance,
please visit our Help/ FAQ section at: http://help.123greetings.com/

We hope you enjoy your ecard,

Your friends at 123Greetings.com
http://www.123greetings.com

We respect your privacy. You will not be receiving any promotional emails from us
because of this ecard. To view our privacy policy, click on the link below:
http://info.123greetings.com/company/privacy_policy.html

Note: This is an auto generated mail. Please do not reply.

If you have any other problem please contact us by clicking on the following link:
http://help.123greetings.com/contact_us.html

This email was sent by 123Greetings.com, Inc., 1674 Broadway, New York, NY 10019.

The malicious payload is at [donotclick]remindingwands.org/main.php?page=861097b084221fd although at the moment it is not responding. This site is hosted on 78.87.123.114 (CYTA, Greece) which is a particularly evil IP that has been seen a lot of lately and can safely be blocked.