This fake NACHA spam leads to malware on porscheforumspb.ru:
Date: Wed, 27 Jun 2012 06:18:09 -0430
From: “Electronic Payments Association” [[email protected]]
Subject: Fwd: ACH Transfer rejectedThe ACH transfer, initiated from your bank account, was canceled.
Canceled transfer:
Bath Nr.: FE-45452995330US
Transaction Report: View
ADELINE Jewell
Automated Clearing House, NACHA
The malicious payload is on [donotclick]porscheforumspb.ru:8080/forum/showthread.php?page=5fa58bce769e5c2c (report here), hosted on the following IPs:
110.234.176.99 (Tulip Telecom, India)
128.134.57.112 (Seoul Kwangun University, Korea)
190.81.107.70 (Telmex, Peru)
Leave a reply
