"End of Aug. Statement Reqiured" spam / hiskintako.ru

This spam leads to malware on hiskintako.ru:

Date:      Tue, 19 Mar 2013 08:04:18 +0300
From:      "package update Ups" [upsdelivercompanyb@ups.com]
Subject:      Re: FW: End of Aug. Statement Reqiured
Attachments:     Invoices-CAS9927.htm

Hi,

as reqeusted I give you inovices issued to you per dec. 2012 ( Internet Explorer file)

Regards

-----------------------

Date:      Tue, 19 Mar 2013 02:18:06 +0600
From:      MyUps [ups-delivery-services@ups.com]
Subject:      Re: FW: End of Aug. Stat. Required

Hi,

as reqeusted I give you inovices issued to you per dec. 2012 ( Internet Explorer file)


Regards

The malicious payload is at [donotclick]hiskintako.ru:8080/forum/links/column.php  (report here) hosted on:
50.22.0.2 (SoftLayer, US)
89.110.131.10 (Netclusive, Germany)
132.230.75.95 (Albert-Ludwigs-Universitaet, Germany)
188.165.202.204 (OVH, France)

BLOCKLIST:
50.22.0.2
89.110.131.10
132.230.75.95
188.165.202.204
forumla.ru
gimiiiank.ru
giminanvok.ru
giminkfjol.ru
giminaaaao.ru
giimiiifo.ru
giliaonso.ru
forumny.ru
hiskintako.ru
gxnaika.ru
gulivaerinf.ru