This fake wire transfer spam leads to malware on geforceexlusive.ru:From: Xanga [mailto:noreply@xanga.com]The malicious payload is at [donotclick]geforceexlusive.ru:8080/forum/links/column.php hosted on the following IPs:
Sent: 12 October 2012 11:27
Subject: Fwd: Wire Transfer Confirmation (FED_6537H57898)
Dear Bank Account Operator,
WIRE TRANSFER: WRE-282857636652198
CURRENT STATUS: PENDING
Please REVIEW YOUR TRANSACTION as soon as possible.
68.67.42.41 (Fibrenoire, Canada)
79.98.27.9 (UAB Interneto Vizija, Lithunia)
203.80.16.81 (MYREN, Malaysia)
These IPs are worth blocking as they will probably also be used in future attacks.
No comments:
Post a Comment