Sponsored by..

Showing posts with label RU:8080. Show all posts
Showing posts with label RU:8080. Show all posts

Thursday, 4 April 2013

"British Airways" spam / igionkialo.ru

This fake British Airways spam leads to malware on igionkialo.ru:
Date:      Thu, 4 Apr 2013 10:19:48 +0330
From:      Marleen Camacho via LinkedIn [member@linkedin.com]
Subject:      British Airways E-ticket receipts
Attachments:     E-Receipt.htm



e-ticket receipt
Booking reference: UMA7760047
Dear,

Thank you for booking with British Airways.

Ticket Type: e-ticket
This is your e-ticket receipt. Your ticket is held in our systems, you will not receive a paper ticket for your booking.

Your itinerary is attached (Internet Exlplorer/Mozilla Firefox file)


Yours sincerely,

British Airways Customer Services

British Airways may monitor email traffic data and also the content of emails, where permitted by law, for the purposes of security and staff training and in order to prevent or detect unauthorised use of the British Airways email system.

British Airways Plc is a public limited company registered in England and Wales. Registered number: 69315274. Registered office: Waterside, PO Box 365, Harmondsworth, West Drayton, Middlesex, England, UB7 0GB.

How to contact us
Although we are unable to respond to individual replies to this email we have a comprehensive section that may help you if you have a question about your booking or travelling with British Airways.


If you require further assistance you may contact us

If you have received this email in error
This is a confidential email intended only for the British Airways Customer appearing as the addressee. If you are not the intended recipient please delete this email and inform the snder as soon as possible. Please note that any copying, distribution or other action taken or omitted to be taken in reliance upon it is prohibited and may be unlawful.

The attachment E-Receipt.htm leads to a malicious landing page at [donotclick]igionkialo.ru:8080/forum/links/column.php (report here) hosted on:
93.187.200.250 (Netdirekt, Turkey)
94.103.45.34 (ANKARAHOSTING, Turkey)
208.94.108.238 (Fibrenoire, Canada)

Blocklist:
93.187.200.250
94.103.45.34
208.94.108.238
hillaryklinton.ru
hiskinta.ru
humaniopa.ru
ifinaksiao.ru
igionkialo.ru
ilianorkin.ru
illuminataf.ru
imanraiodl.ru
imbrigilia.ru
ivanikako.ru
ixxtigang.ru
izamalok.ru
izjianokr.ru

Wednesday, 3 April 2013

"Have you seen how much money has Cameron spent on his new movie?" spam / ixxtigang.ru

This old-fashioned spam leads to malware on ixxtigang.ru:

Date:      Wed, 3 Apr 2013 11:29:19 +0400
From:      LinkedIn Password [password@linkedin.com]
Subject:      I??�m shocked!

Have you seen how much money has Cameron spent on his new movie?
What a graphics, check out the trailer!
The malicous payload is at [donotclick]ixxtigang.ru:8080/forum/links/column.php (report here) hosted on the same IPs used in this attack:
93.187.200.250 (Netdirekt, Turkey)
94.103.45.34 (ANKARAHOSTING, Turkey)
208.94.108.238 (Fibrenoire, Canada)

Blocklist:
93.187.200.250
94.103.45.34
208.94.108.238
izamalok.ru
imbrigilia.ru
humaniopa.ru
hiskinta.ru
illuminataf.ru
ilianorkin.ru
hillaryklinton.ru
izjianokr.ru
ivanikako.ru
ixxtigang.ru

eFax spam / ivanikako.ru

This fake eFax spam leads to malware on ivanikako.ru:

From: Global Express UPS [mailto:admin@ups.com]
Sent: 02 April 2013 21:12
Subject: Efax Corporate

Fax Message [Caller-ID: 189609656]

You have received a 40 pages fax at Wed, 3 Apr 2013 02:11:58 +0600, (708)-009-8464.

* The reference number for this fax is [eFAX-698329221].

View attached fax using your Internet Browser.

________________________________________
© 2013 j2 Global Communications, Inc. All rights reserved.
eFax Ž is a registered trademark of j2 Global Communications, Inc.

This account is subject to the terms listed in the eFax Ž Customer Agreement. 
The malicious payload is at [donotclick]ivanikako.ru:8080/forum/links/column.php (report here) hosted on:
93.187.200.250 (Netdirekt, Turkey)
94.103.45.34 (ANKARAHOSTING, Turkey)
208.94.108.238 (Fibrenoire, Canada)

Blocklist:
93.187.200.250
94.103.45.34
208.94.108.238
izamalok.ru
imbrigilia.ru
humaniopa.ru
hiskinta.ru
illuminataf.ru
ilianorkin.ru
hillaryklinton.ru
izjianokr.ru
ivanikako.ru

Tuesday, 2 April 2013

Sendspace spam / imbrigilia.ru

This fake Sendspace spam leads to malware on imbrigilia.ru:

Date:      Tue, 2 Apr 2013 03:57:26 +0000
From:      "JOSIE HARMON" [HARMON_JOSIE@hotmail.com]
Subject:      You have been sent a file (Filename: [redacted]-7191.pdf)

Sendspace File Delivery Notification:

You've got a file called [redacted]-463168.pdf, (172.5 KB) waiting to be downloaded at sendspace.(It was sent by JOSIE HARMON).



You can use the following link to retrieve your file:



Download Link



The file may be available for a limited time only.



Thank you,

sendspace - The best free file sharing service.

----------------------------------------------------------------------

Please do not reply to this email. This auto-mailbox is not monitored and you will not receive a response.

The malicious payload is at [donotclick]imbrigilia.ru:8080/forum/links/column.php (report here) hosted on the same IPs used in this attack:
80.246.62.143 (Alfahosting GmbH, Germany)
94.103.45.34 (ANKARAHOSTING, Turkey)

Blocklist:
80.246.62.143
94.103.45.34
humaniopa.ru
hiskinta.ru
illuminataf.ru
izamalok.ru
ilianorkin.ru
hillaryklinton.ru
izjianokr.ru
ivanovoposel.ru
hohohomaza.ru
imbrigilia.ru

"End of Aug. Statement Required" spam / ivanovoposel.ru

This spam leads to malware on ivanovoposel.ru:

From: messages-noreply@bounce.linkedin.com [mailto:messages-noreply@bounce.linkedin.com] On Behalf Of LinkedIn
Sent: 02 April 2013 10:15
Subject: Re: FW: End of Aug. Statement Reqiured

Hallo,
as reqeusted I give you inovices issued to you per jan. (Microsoft Internet Explorer).

Regards
SHONTA SCHMITT
Alternate names:
NORIKO Richmond
Raiden MORRISON

Attachments:
Invoice_U13726798.htm
Invoice_U453718.htm
Invoice_U913687.htm

The attachment leads to malware on [donotclick]ivanovoposel.ru:8080/forum/links/column.php (report here) hosted on:
80.246.62.143 (Alfahosting GmbH, Germany)
94.103.45.34 (ANKARAHOSTING, Turkey)

Blocklist:
80.246.62.143
94.103.45.34
humaniopa.ru
hiskinta.ru
illuminataf.ru
izamalok.ru
ilianorkin.ru
hillaryklinton.ru
izjianokr.ru
ivanovoposel.ru
hohohomaza.ru

Thursday, 28 March 2013

ADP Spam / ipiniadto.ru

This fake ADP spam leads to malware on ipiniadto.ru:

Date:      Thu, 28 Mar 2013 04:22:48 +0600 [03/27/13 18:22:48 EDT]
From:      Bebo Service [service@noreply.bebo.com]
Subject:      ADP Immediate Notification

ADP Immediate Notification
Reference #: 120327398

Thu, 28 Mar 2013 04:22:48 +0600
Dear ADP Client

Your Transfer Record(s) have been created at the web site:

https://www.flexdirect.adp.com/client/login.aspx

Please see the following notes:

    Please note that your bank account will be debited within one banking business day for the amount(s) shown on the report(s).
    Please do not respond or reply to this automated e-mail. If you have any questions or comments, please Contact your ADP Benefits Specialist.


This note was sent to acting users in your system that approach ADP Netsecure.

As usual, thank you for choosing ADP as your business affiliate!

Ref: 975316004
HR. Payroll. Benefits.

The ADP logo and ADP are registered trademarks of ADP, Inc.
In the business of your success is a service mark of ADP, Inc.
© 2013 ADP, Inc. All rights reserved.
The malicious landing page and recommended blocklist are the same as for this parallel attack also running today.

Facebook spam / ipiniadto.ru

The email address says Filestube. The message says Facebook. This can't be good.. and in fact this message just leads to malware on ipiniadto.ru:

Date:      Thu, 28 Mar 2013 04:58:33 +0600 [03/27/13 18:58:33 EDT]
From:      FilesTube [filestube@filestube.com]
Subject:      You have notifications pending

facebook
Hi,
Here's some activity you may have missed on Facebook.
BERTIE Goldstein has posted statuses, photos and more on Facebook.
Go To Facebook
   
See All Notifications
This message was sent to [redacted]. If you don't want to receive these emails from Facebook in the future or have your email address used for friend suggestions, please click: unsubscribe.
Facebook, Inc. Attention: Department 415 P.O Box 10005 Palo Alto CA 94303 
The malicious payload is at [donotclick]ipiniadto.ru:8080/forum/links/column.php (report here) hosted on the same IPs as used in this attack:

66.249.23.64 (Endurance International Group, US)
69.46.253.241 (RapidDSL & Wireless, US)
140.114.75.84 (TANET, Taiwan)

Blocklist:
66.249.23.64
69.46.253.241
140.114.75.84
heepsteronst.ru
hillairusbomges.ru
hillaryklinton.ru
hinakinioo.ru
hiskinta.ru
hjuiopsdbgp.ru
hohohomaza.ru
hondatravel.ru
humaniopa.ru
humarikanec.ru
ilianorkin.ru
iliminattii.ru
illuminataf.ru
ipiniadto.ru


"Scan from a Xerox W. Pro" spam / ilianorkin.ru

This fake printer spam leads to malware on ilianorkin.ru:

From: officejet@[victimdomain]
Sent: 27 March 2013 08:35
Subject: Fwd: Fwd: Scan from a Xerox W. Pro #589307

A Document was sent to you using a XEROX WorkJet PRO 481864299.

SENT BY : Omar
IMAGES : 9
FORMAT (.JPEG) DOWNLOAD
The malicious payload is at [donotclick]ilianorkin.ru:8080/forum/links/column.php (report here) hosted on:

66.249.23.64 (Endurance International Group, US)
69.46.253.241 (RapidDSL & Wireless, US)
140.114.75.84 (TANET, Taiwan)

Blocklist:
66.249.23.64
69.46.253.241
140.114.75.84
humaniopa.ru
hiskinta.ru
hohohomaza.ru
humarikanec.ru
hondatravel.ru
hillaryklinton.ru
hinakinioo.ru
hjuiopsdbgp.ru
hillairusbomges.ru
heepsteronst.ru
ilianorkin.ru
iliminattii.ru
illuminataf.ru

Wednesday, 27 March 2013

"British Airways E-ticket receipts" spam / illuminataf.ru

This fake airline ticket spam leads to malware on illuminataf.ru:


Date:      Wed, 27 Mar 2013 03:23:05 +0100
From:      "Xanga" [noreply@xanga.com]
Subject:      British Airways E-ticket receipts
Attachments:     E-Ticket-Receipt.htm

e-ticket receipt
Booking reference: JQ15191488
Dear,

Thank you for booking with British Airways.

Ticket Type: e-ticket
This is your e-ticket receipt. Your ticket is held in our systems, you will not receive a paper ticket for your booking.

Your itinerary is attached (Internet Exlplorer/Mozilla Firefox file)


Yours sincerely,

British Airways Customer Services

British Airways may monitor email traffic data and also the content of emails, where permitted by law, for the purposes of security and staff training and in order to prevent or detect unauthorised use of the British Airways email system.

British Airways Plc is a public limited company registered in England and Wales. Registered number: 51298446. Registered office: Waterside, PO Box 365, Harmondsworth, West Drayton, Middlesex, England, UB7 0GB.

How to contact us
Although we are unable to respond to individual replies to this email we have a comprehensive section that may help you if you have a question about your booking or travelling with British Airways.


If you require further assistance you may contact us

If you have received this email in error
This is a confidential email intended only for the British Airways Customer appearing as the addressee. If you are not the intended recipient please delete this email and inform the snder as soon as possible. Please note that any copying, distribution or other action taken or omitted to be taken in reliance upon it is prohibited and may be unlawful.

The attackment E-Ticket-Receipt.htm (which has a poor detection rate) leads to a malicious payload at [donotclick]illuminataf.ru:8080/forum/links/column.php (report here) hosted on:
66.249.23.64 (Endurance International Group, US)
69.46.253.241 (RapidDSL & Wireless, US)
223.4.209.134 (Alibaba (China) Technology Co, China)

Blocklist:
66.249.23.64
69.46.253.241
223.4.209.134
humaniopa.ru
hiskinta.ru
hohohomaza.ru
humarikanec.ru
hillaryklinton.ru
hinakinioo.ru
hillairusbomges.ru
heepsteronst.ru
hjuiopsdbgp.ru
hondatravel.ru
illuminataf.ru
iliminattii.ru

Tuesday, 26 March 2013

"NY TRAFFIC TICKET" spam / hondatravel.ru

I haven't seen this type of spam for a while, but here it is.. leading to malware on hondatravel.ru:

Date:      Wed, 27 Mar 2013 04:24:14 +0330
From:      "LiveJournal.com" [do-not-reply@livejournal.com]
Subject:      Fwd: Re: NY TRAFFIC TICKET

New-York Department of Motor Vehicles

TRAFFIC TICKET
NEW-YORK POLICE DEPARTMENT
THE PERSON CHARGED AS FOLLOWS

Time: 2:15 AM

Date of Offense: 28/07/2012



SPEED OVER 50 ZONE

TO PLEAD CLICK HERE AND FILL OUT THE FORM
The malicious payload appears to be identical to this spam run earlier today.

Wire Transfer spam / hondatravel.ru

This fake Wire Transfer spam leads to malware on hondatravel.ru:

From: messages-noreply@bounce.linkedin.com [mailto:messages-noreply@bounce.linkedin.com] On Behalf Of LinkedIn
Sent: 26 March 2013 11:52
Subject: Re: Wire Transfer Confirmation (FED_4402D79813)

Dear Bank Account Operator,
WIRE TRANSFER: FED68081773954793456
CURRENT STATUS: PENDING

Please REVIEW YOUR TRANSACTION as soon as possible.

The malicious payload is at [donotclick]hondatravel.ru:8080/forum/links/column.php (report here) hosted on:

66.249.23.64 (Endurance International Group, US)
69.46.253.241 (RapidDSL & Wireless, US)

These IPs were seen earlier with this attack.

eFax Corporate spam / hjuiopsdbgp.ru

This fake eFax spam leads to malware on hjuiopsdbgp.ru:

Date:      Tue, 26 Mar 2013 06:23:36 +0800
From:      LinkedIn [welcome@linkedin.com]
Subject:      Efax Corporate
Attachments:     Efax_Pages.htm



Fax Message [Caller-ID: 378677295]

You have received a 59 pages fax at Tue, 26 Mar 2013 06:23:36 +0800, (954)-363-5285.

* The reference number for this fax is [eFAX-677484317].

View attached fax using your Internet Browser.


© 2013 j2 Global Communications, Inc. All rights reserved.
eFax ® is a registered trademark of j2 Global Communications, Inc.

This account is subject to the terms listed in the eFax ® Customer Agreement.
The attachment Efax_Pages.htm leads to a malicious payload at [donotclick]hjuiopsdbgp.ru:8080/forum/links/column.php (report here) hosted on the following IPs:
66.249.23.64 (Endurance International Group, US)
69.46.253.241 (RapidDSL & Wireless, US)
95.211.154.196 (Leaseweb, Netherlands)

Blocklist:
66.249.23.64
69.46.253.241
95.211.154.196
hohohomaza.ru
humarikanec.ru
hillaryklinton.ru
hinakinioo.ru
hillairusbomges.ru
hjuiopsdbgp.ru
heepsteronst.ru


Monday, 25 March 2013

"Copies of policies" spam / heepsteronst.ru

This spam leads to malware on heepsteronst.ru:

Date:      Mon, 25 Mar 2013 06:20:54 -0500 [07:20:54 EDT]
From:      Ashley Madison [donotreply@ashleymadison.com]
Subject:      RE: DEBBRA - Copies of Policies.

Unfortunately, I cannot obtain electronic copies of the Ocean, Warehouse or EPLI policy.
Here is the Package and Umbrella,

and a copy of the most recent schedule.


DEBBRA Barnard, 

The malicious payload is at [donotclick]heepsteronst.ru:8080/forum/links/column.php (report here). The IP addresses used are the same ones as used in this attack.

"Scan from a HP ScanJet" spam / humaniopa.ru

This fake printer spam leads to malware on humaniopa.ru:

Date:      Mon, 25 Mar 2013 03:57:54 -0500
From:      LinkedIn Connections [connections@linkedin.com]
Subject:      Scan from a HP ScanJet #928909620
Attachments:     Scanned_Document.htm

Attached document was scanned and sent

to you using a Hewlett-Packard HP Officejet 98278P.

Sent by: CHANG
Images : 5
Attachment Type: .HTM [INTERNET EXPLORER]

Hewlett-Packard Officejet Location: machine location not set
The attachment Scanned_Document.htm leads to malware on [donotclick]humaniopa.ru:8080/forum/links/column.php (report here) hosted on:
66.249.23.64 (Endurance International Group, US)
72.11.155.182 (OC3 Networks, US)
72.167.254.194 (GoDaddy, US)
95.211.154.196 (Leaseweb, Netherlands)

Blocklist:
66.249.23.64
72.11.155.182
72.167.254.194
95.211.154.196
hohohomaza.ru
hillaryklinton.ru
hinakinioo.ru
hillairusbomges.ru
humaniopa.ru
humarikanec.ru


Friday, 22 March 2013

Changelog spam / hohohomaza.ru

Evil changelog spam episode 274, leading to malware on hohohomaza.ru. Hohoho indeed.

Date:      Fri, 22 Mar 2013 11:06:48 -0430
From:      Hank Sears via LinkedIn [member@linkedin.com]
Subject:      Fwd: Changelog as promised (upd.)

Hello,

as promised changelog - View

L. HENDRICKS

The malware landing page is at [donotclick]hohohomaza.ru:8080/forum/links/column.php (report here) hosted on:
50.22.0.2 (Softlayer / Monday Sessions Media, US)
66.249.23.64  (Endurance International Group, US)
80.246.62.143 (Alfahosting / Host Europe, Germany)

Blocklist:
50.22.0.2
66.249.23.64
80.246.62.143
hillaryklinton.ru
hohohomaza.ru
hillairusbomges.ru
hentaimusika.ru
himalayaori.ru
hiskintako.ru
heelicotper.ru
hinpoka.ru

Changelog spam / hillairusbomges.ru

This fake changelog spam leads to malware on hillairusbomges.ru:

Date:      Thu, 21 Mar 2013 03:01:59 -0500 [04:01:59 EDT]
From:      LinkedIn Email Confirmation [emailconfirm@linkedin.com]
Subject:      Re: Changelog Oct.

Good morning,
as prmised updated changelog - View

L. LOYD
The malicious payload is at [donotclick]hillairusbomges.ru:8080/forum/links/column.php (report here) hosted on:
50.22.0.2 (Softlayer / Monday Sessions Media, US)
66.249.23.64 (Endurance International Group, US)
188.165.202.204 (OVH, France)

Blocklist:
50.22.0.2
66.249.23.64
188.165.202.204
gxnaika.ru
hentaimusika.ru
forumla.ru
gulivaerinf.ru
foruminanki.ru
heelicotper.ru
forumny.ru
hillairusbomges.ru
hillaryklinton.ru
hinpoka.ru
hifnsiiip.ru

Thursday, 21 March 2013

"Scan from a Hewlett-Packard ScanJet" spam / hillaryklinton.ru

This fake printer spam leads to malware on the amusingly-named hillaryklinton.ru:

From: messages-noreply@bounce.linkedin.com [mailto:messages-noreply@bounce.linkedin.com] On Behalf Of LinkedIn Password
Sent: 21 March 2013 06:56
Subject: Scan from a Hewlett-Packard ScanJet #269644

Attached document was scanned and sent
to you using a Hewlett-Packard HP Officejet 6209P.

Sent by: SANDIE
Images : 1
Attachment Type: .HTM [INTERNET EXPLORER]

Hewlett-Packard Officejet Location: machine location not set
In this case there is an attachment called Scanned_Document.htm which leads to a malicious payload at [donotclick]hillaryklinton.ru:8080/forum/links/column.php (report here) hosted on:

50.22.0.2 (SoftLayer, US)
62.75.157.196 (Inergenia, Germany)
109.230.229.156 (High Quality Server, Germany)

Blocklist:
50.22.0.2
62.75.157.196
109.230.229.156
foruminanki.ru
forumla.ru
forumny.ru
gulivaerinf.ru
gxnaika.ru
hanofk.ru
heelicotper.ru
hifnsiiip.ru
hillaryklinton.ru
himalayaori.ru
humalinaoo.ru



Wednesday, 20 March 2013

"End of Aug. Statement" spam / hifnsiiip.ru

This fake invoice spam leads to malware on hifnsiiip.ru:

Date:      Wed, 20 Mar 2013 05:41:44 +0100
From:      LinkedIn Connections [connections@linkedin.com]
Subject:      Re: FW: End of Aug. Statement
Attachments:     Invoices-AS9927.htm

Good morning,

as reqeusted I give you inovices issued to you per dec. 2012 ( Internet Explorer file)

Regards
The attached Invoices-AS9927.htm file attempts to direct the victim to a malicious landing page [donotclick]hifnsiiip.ru:8080/forum/links/column.php (report here) hosted on:

50.22.0.2 (SoftLayer, US)
109.230.229.156 (High Quality Server, Germany)
188.165.202.204 (OVH, France)

Recommended blocklist:
50.22.0.2
109.230.229.156
188.165.202.204
foruminanki.ru
forumla.ru
forumny.ru
giimiiifo.ru
giliaonso.ru
gimiiiank.ru
giminaaaao.ru
giminanvok.ru
giminkfjol.ru
gulivaerinf.ru
gxnaika.ru
hentaimusika.ru
hifnsiiip.ru
himalayaori.ru
hiskintako.ru

USPS Spam / himalayaori.ru

This fake UPS (or is it USPS?) spam leads to malware on  himalayaori.ru. The malicious link is in an attachment called ATT17235668.htm.

For some reason the only sample of the spam that I have is horribly mangled:

From: HamzaRowson@hotmail.com [mailto:HamzaRowson@hotmail.com]
Sent: 19 March 2013 23:40
Subject: United Postal Service Tracking Number H1338091657

                                                                                                                          Your USPS TEAM for big savings!                    Can't see images? CLICK HERE.                                                                                                                                                                                                                                                                                                                                                                                       UPS UPS SUPPORT 56                                                                                                                                                                                                                                                                                                                                                                                                                   Not Ready to Open an Account? The UPS Store® can help with full service packing and shipping.Learn More >>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        UPS - Your UPS Team                                                                                                                                                                Good day, [redacted].      
      
                        Dear User , Delivery Confirmation: Failed

                                Track your Shipment now!

                                            With best regards , Your UPS Customer Services.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Shipping                                      Tracking                                       Calculate Time & Cost                                      Open an Account                                                                                                                                                                                                                                                                @ 2011 United Parcel Service of America, Inc. USPS Team, the UPS brandmark, and the color brown are             trademarks of United Parcel Service of America, Inc. All rights reserved.                        This is a marketing e-mail for UPS services. Click here to update your e-mail preferences or to unsubscribe to             USPS .us Customer Services marketing e-mail For information on UPS's privacy practices, please refer to UPS Privacy Policy.                        Your USPS .US, 5 Glenlake Parkway, NE - Atlanta, GA 30325            Attn: Customer Communications Department                                                                               


Clicking on the attachment sends the intended victim to a malicious web page at [donotclick]himalayaori.ru:8080/forum/links/column.php (report here), in this case via a legitimate hacked site at [donotlick]www.unisgolf.ch/report.htm but that is less important.

himalayaori.ru is hosted on a couple of IPs that look familiar:

50.22.0.2 (SoftLayer, US)
188.165.202.204 (OVH, France)

Recommended blocklist:
50.22.0.2
188.165.202.204
himalayaori.ru
hentaimusika.ru
hiskintako.ru
gxnaika.ru
forumla.ru
gulivaerinf.ru
foruminanki.ru
forumny.ru

Tuesday, 19 March 2013

Facebook spam / heelicotper.ru

This fake Facebook spam leads to malware on heelicotper.ru:

Date:      Tue, 19 Mar 2013 08:37:37 +0200
From:      Facebook [updateSIXQG03I44AX@facebookmail.com]
Subject:      You have notifications pending

facebook
Hi,
Here's some activity you may have missed on Facebook.
TAMISHA Gore has posted statuses, photos and more on Facebook.
Go To Facebook
   
See All Notifications
This message was sent to [redacted]. If you don't want to receive these emails from Facebook in the future or have your email address used for friend suggestions, please click: unsubscribe.

Facebook, Inc. Attention: Department 415 P.O Box 10005 Palo Alto CA 94303
The malicious payload is at [donotclick]heelicotper.ru:8080/forum/links/column.php which isn't resolving at the moment, but was earlier hosted on:

50.22.0.2 (SoftLayer, US)
132.230.75.95 (Albert-Ludwigs-Universitaet, Germany)
188.165.202.204 (OVH, France)

The payload and associated IPs are the same as in this attack.