More fake NACHA spam, this time leading to a malicious payload site on downloaddatafast.serveftp.com/main.php?page=977334ca118fcb8c on 173.230.137.34 (Linode, US).
Date: Tue, 13 Dec 2011 14:15:51 +0100
From: “LinkedIn” [linkedin@em.linkedin.com]
Subject: ACH transaction not acceptedThe ACH transfer (ID: 82065701523728), recently initiated from your checking account (by you or any other person), was rejected by the Electronic Payments Association.
Canceled transfer
Transaction ID: 82065701523728
Rejection Reason See details in the report below
Transaction Report report_82065701523728.doc (Microsoft Word Document)13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100
© 2011 NACHA – The Electronic Payments Association
serveftp.com is related to no-ip.com, if you block that domain then you should probably block serveftp.com as well. Blocking 173.230.137.34 would protect against any other malicious sites on the same server.
Leave a reply
