The email looks something like this:
Subject: Re: FW: End of Aug. Statement ReqiuredThe email contains a link going to one of the malicious sites hosted on the server. At the moment I can identify the following sites:
Good morning,
as reqeusted I give you inovices issued to you per sept.
Download Invoice
Regards
CHEREE DUNHAM
associationandmyblog.info
associationandmyexperience.info
association-and-my-experience.info
associationandmyexperienceblog.info
associationandmyexperienceonline.info
associationandmyexperiencesite.info
associationandmyonline.info
associationandmysite.info
associationandmystore.info
associationchoose.info
association-choose.info
associationcourse.info
associationcreationblog.info
associationcreationonline.info
associationcreationsite.info
associationcreationstore.info
associationearth.info
association-earth.info
associationed.info
association-ed.info
associationeducationblog.info
associationeducationonline.info
associationeducationsite.info
associationeducationstore.info
associationepoch.info
associationformationblog.info
associationformationonline.info
associationformationsite.info
associationformationstore.info
associationgenerationblog.info
associationgenerationonline.info
associationgenerationsite.info
associationgenerationstore.info
associationgethome.info
associationglobe.info
associationgohome.info
association-go-home.info
associationgohomeblog.info
associationgohomeonline.info
associationgohomestore.info
associationgohouse.info
associationinterval.info
associationlearning.info
associationlifetime.info
associationlongword.info
association-long-word.info
associationlongwordblog.info
associationlongwordonline.info
associationlongwordsite.info
associationlongwordstore.info
associationminute.info
associationmonth.info
associationmovehome.info
associationmultiplicationblog.info
associationmultiplicationsite.info
associationmultiplicationstore.info
associationmusicsanalarm.info
associationnewsblog.info
associationnewsmedia.info
associationnewsonline.info
associationnewssite.info
associationnewsstore.info
association-newstageofdevelopmentblog.info
association-newstageofdevelopmentonline.info
association-newstageofdevelopmentsite.info
association-newstageofdevelopmentstore.info
associationnmyexperience.info
associationnmyknowledge.info
associationprogenyblog.info
associationprogenyonline.info
associationprogenysite.info
associationprogenystore.info
associationrace.info
association-race.info
associationraceblog.info
associationraceonline.info
associationracesite.info
associationracestore.info
associationreproductionblog.info
associationreproductiononline.info
associationreproductionsite.info
associationreproductionstore.info
associationschool.info
association-school.info
associationsecond.info
associationselectblog.info
associationselectonline.info
associationselectstore.info
associationsoundsanalarm.info
association-sound-san-alarm.info
associationsoundsanalarmblog.info
associationsoundsanalarmonline.info
associationsoundsanalarmsite.info
associationsoundsanalarmstore.info
associationsoundsanpanic.info
associationspeed.info
associationtime.info
association-time.info
associationtimeblog.info
associationtimeonline.info
associationtimesite.info
associationtimestore.info
associationtonesanalarm.info
associationtrapsblog.info
associationtrapsonline.info
associationtrapssite.info
associationtrapsstore.info
associationuniverse.info
associationworld.info
association-world.info
associationworldblog.info
associationworldonline.info
associationworldsite.info
associationworldstore.info
bestassociationandmyexperience.info
bestassociationgohome.info
bestassociationlongword.info
bestassociationrace.info
bestassociationsoundsanalarm.info
bestassociationtime.info
bestassociationworld.info
dollar-krise.de
eredirect.ru
fortunatemoney.in
fortunate-money.in
fotv.in
freeassociationandmyexperience.info
freeassociationgohome.info
freeassociationlongword.info
freeassociationrace.info
freeassociationsoundsanalarm.info
freeassociationtime.info
freeassociationworld.info
groupandmyexperience.info
groupandmyexpertise.info
groupandmyknowledge.info
groupchoose.info
group-choose.info
groupextendedword.info
groupextensiveword.info
groupgethome.info
group-get-home.info
groupgohome.info
group-go-home.info
grouplengthyword.info
grouplongmessage.info
grouplongphrase.info
grouplongsaying.info
grouplongword.info
groupnmyexperience.info
groupnmyknowledge.info
groupprolongedword.info
group-race.info
groupschool.info
group-time.info
groupworld.info
group-world.info
kitr.in
logisticperu.in
myassociationandmyexperience.info
myassociationgohome.info
myassociationlongword.info
myassociationrace.info
myassociationsoundsanalarm.info
myassociationtime.info
myassociationworld.info
newassociationandmyexperience.info
newassociationgohome.info
newassociationlongword.info
newassociationrace.info
newassociationsoundsanalarm.info
newassociationtime.info
newassociationworld.info
organizationandmyexperience.info
organization-choose.info
organizationgethome.info
organizationgohome.info
organization-go-home.info
organizationnmyexperience.info
organizationrace.info
organization-race.info
organizationsoundsanalarm.info
organizationtime.info
organization-time.info
organizationworld.info
organization-world.info
pzmjrv.5iai-shop.co.uk
searchassociationblog.info
searchassociationonline.info
searchassociationsite.info
searchassociationstore.info
theassociationandmyexperience.info
theassociationgohome.info
theassociationlongword.info
theassociationrace.info
theassociationsoundsanalarm.info
theassociationtime.info
theassociationworld.info
wfdjszyzou.ce.ms
widgetharden.in
widgetwithstand.in
xore.in
xxxi.us.to