Date: Thu, 26 Apr 2012 09:33:46 -0700
From: “Facebook” [notification+xxxxxxxxxxx[email protected]]
Subject: Welcome back to Facebook
The Facebook account associated with xxxxxxxxxxx was recently reactivated.
If you were not the one who reactivated this account, please visit our Help Center to cancel the request.
The Facebook Team
The payload is a pharma site at bioldrugstore.com hosted on 188.8.131.52 and 184.108.40.206 in China (two IPs that are full of fake pharma stores) and 220.127.116.11 in Spain.
This type of spam run can easily be adapted for malware, so keep an eye out for unexpected Facebook notifications.
Leave a reply