The Latest in IT Security

Today’s spam runs are just firing up now, with a fake BBB spam containing at attachment that tries to direct visitors to cjhsdvbfbczuet.ru.

Date:      Wed, 7 Mar 2012 -06:40:22 -0800
From:      “FANNY Baez”
Subject:      Better Business Bureau Complaint
Attachments:     Complaint_ID87rP25441.htm

Good afternoon,

Here with the Better Business Bureau would like to inform you that we have received a complaint (ID 323259211) from a customer of yours in regard to their dealership with you.

Please open the COMPLAINT REPORT attached to this email (open with Internet Explorer/Firefox)
to view the details on this issue and suggest us about your position as soon as possible.

We hope to hear from you shortly.

Regards,
FANNY Baez

Dispute Counselor
Better Business Bureau

The payload site is at cjhsdvbfbczuet.ru:8080/images/aublbzdni.php but at the moment it doesn’t seem to be resolving so there are no IPs to block. However, monitoring your logs for .ru:8080 from time-to-time could help detect users who have clicked through.