NACHA spam / breathtakingundistinguished.biz

This fake NACHA spam leads to malware on breathtakingundistinguished.biz:

From: "Гена.Симонов@direct.nacha.org" [mailto:corruptnessljx953@bsilogistik.com]
Sent: 25 March 2013 22:26
Subject: Re: Your Direct Deposit disallowance
Importance: High

Attn: Accounting Department

We are sorry to notify you, that your latest Direct Deposit transaction (#963417979218) was disallowed,because your business software package was out of date. The detailed information about this matter is available in the secure section of our web site:

Click here for more information

Please consult with your financial institution to acquire the updated version of the software.

Yours truly,

ACH Network Rules Department
NACHA - The Electronic Payments Association


19681 Sunrise Valley Drive, Suite 275
Herndon, VA 20135
Phone: 703-561-1796 Fax: 703-787-1698

The malicious payload is at [donotclick]breathtakingundistinguished.biz/closest/209tuj2dsljdglsgjwrigslgkjskga.php (report here) hosted on 62.173.138.71 (Internet-Cosmos Ltd., Russia). The following malicious sites are also hosted on the same server:


necessarytimealtering.biz
hitwiseintelligence.biz
breathtakingundistinguished.biz