Sponsored by..

Friday 12 October 2012

Wire Transfer spam / geforceexlusive.ru

This fake wire transfer spam leads to malware on geforceexlusive.ru:

From: Xanga [mailto:noreply@xanga.com]
Sent: 12 October 2012 11:27
Subject: Fwd: Wire Transfer Confirmation (FED_6537H57898)

Dear Bank Account Operator,
WIRE TRANSFER: WRE-282857636652198
CURRENT STATUS: PENDING

Please REVIEW YOUR TRANSACTION as soon as possible.
The malicious payload is at [donotclick]geforceexlusive.ru:8080/forum/links/column.php hosted on the following IPs:

68.67.42.41 (Fibrenoire, Canada)
79.98.27.9 (UAB Interneto Vizija, Lithunia)
203.80.16.81 (MYREN, Malaysia)

These IPs are worth blocking as they will probably also be used in future attacks.




No comments: