Sponsored by..

Monday 11 March 2013

Wire Transfer spam / giminanvok.ru

Another wire transfer spam, this time leading to malware on giminanvok.ru:

Date:      Mon, 11 Mar 2013 02:46:19 -0300 [01:46:19 EDT]
From:      LinkedIn Connections [connections@linkedin.com]
Subject:      Fwd: Wire Transfer (5600LJ65)

Dear Bank Account Operator,

WIRE TRANSFER: FED694760330367340

Please REVIEW YOUR TRANSACTION as soon as possible.
The malicious payload is at [donotclick]giminanvok.ru:8080/forum/links/column.php (report pending) hosted on the same IPs used earlier today: (Hetzner, Germany) (Endurance International Group, US) (Netinternet, Turkey)

 I strongly recommend that you block access to these IPs if you can.

No comments: