Sponsored by..

Sunday 30 September 2012

ADP Spam / 69.194.194.221

This fake ADP spam leads to malware on 69.194.194.221:


Date:      Sun, 30 Sep 2012 17:31:05 +0200
From:      "ADP Service" [F07EBCC@pop3.rad.net]
Subject:      New transactions

Your Transaction Report(s) have been uploaded to the web site:



https://www.flexdirect.adp.com/client/login.aspx



Please note that your bank account will be debited within one banking

business day for the amount(s) shown on the report(s).



Please do not respond or reply to this automated e-mail. If you have any

questions or comments, please Contact your ADP Benefits Specialist.



Thank You,

ADP Benefit Services


The malicious payload is at [donotclick]69.194.194.221/links/marked-alter.php (Solar VPS, US).

No comments: