Sponsored by..

Friday 5 October 2012

"Intuit GoPayment" spam / simplerkwiks.net

This fake "Intuit GoPayment" spam leads to malware on simplerkwiks.net:


Date:      Fri, 5 Oct 2012 15:54:26 +0100
From:      "Intuit GoPayment" [abstractestknos65@pacunion.com]
Subject:      Welcome - you're been granted access for Intuit GoPayment Merchant

       
.
Greetings & Congrats!
Your GoPayment? statement for WALLET , DEVELOPMENTS has been issued.
Intuit Payment
Account No.:     XXXXXXXXXXXXXX16
Email Address:     [redacted]
   
NOTE :
    Additional charges for this service may now apply.
Next step: Confirm your User ID



This is Very Important lets you:
Manage your payment service in the Merchant Center
Review charges
Log In to other Intuit products you may use, like TurboTax, Quicken, and Intuit Payroll


The good news is you have active an existing Intuit account for your email address, You can use this ID for your payment service also, or enter a new one.



Verify UserID
Get started:



Step 1: If you have not still, download the Intuit application.



Step 2: Run the GoPayment app and sign in with the UserID (your email address) and Password you setup.



Easy Manage Your GoPayment System

The Intuit GoPayment Merchant Service Center is the website where you can learn a lot about GoPayment features, customize your sales receipt and add GoPayment users. You can also manage transactions, deposits and fees. Visit link and signin with your GoPayment Access ID (your email address) and Password.
For more information on how to get started using Intuit Merchant, including tutorials, FAQs and other resources, visit the Service Center at web site.
Please do not reply to this message. automative notification system not configured to accept incoming email.
System Terms & Agreements     � 2012 Intuit, Inc. All rights reserved.


The malicious payload is at [donotclick]simplerkwiks.net/detects/congrats_verify-access.php hosted on 183.81.133.121 (Vodafone, Fiji) along with these other suspect domains:
addsmozy.net
officerscouldexecute.org
simplerkwiks.net
strangernaturallanguage.net
buzziskin.net
art-london.net


No comments: