Sponsored by..

Wednesday 23 January 2013

Corporate eFax spam / 13.carnovirious.net

This spam is leading to malware on 13.carnovirious.net, a domain spotted earlier today.. but one that has switched server to 74.91.117.49 since then.

From:     Corporate eFax [message@inbound.efax.com] via luther.k12.wi.us
Date:     23 January 2013 15:52
Subject:     Corporate eFax message - 4 pages
Mailed-by:     luther.k12.wi.us


Fax Message [Caller-ID: 607-652-2962]
You have received a 4 pages fax at 2013-01-23 12:00:13 GMT.

* The reference number for this fax is min1_did27-5667781893-3154150936-31.

View this fax using your PDF reader.

Click here to view this message

Please visit www.eFax.com/en/efax/twa/page/help if you have any questions regarding this message or your service.
Thank you for using the eFax service!
Home Contact Login
Powered by j2
2013 j2 Global Communications, Inc. All rights reserved.
eFax is a registered trademark of j2 Global Communications, Inc.
This account is subject to the terms listed in the eFax Customer Agreement.

The spam leads to an exploit kit on [donotclick]13.carnovirious.net/read/persons_jobs.php hosted on 74.91.117.49 by Nuclear Fallout Enterprises. You should probably block 74.91.117.50 as well.


The following domains are on these two IPs:
13.jonemnominik.net
13.lomerdaster.net
13.zabakarvester.net
13.carnovirious.net
13.blumotorada.net

No comments: