Phishing url sent via email.

[HGPower]

Code: [Select]

http://fumiexpreso.com.mx/uj2/996607.htmlRedirects to:

Code: [Select]

http://hghda.ru/ (Canadian Pharmacy webpage)

[sandy2kece]

Here are some

hxxp://www.usps.com.usg3o1.com/shipping/trackandconfirm.php?navigation=1&respLang=Eng&resp=10242012
hxxps://app.getresponse.com/confirm.html?x=a62b&sq=Rzk2Z&y=Z&

redirects to

hxxp://www.usps.com.usg3o1.com/shipping/775gK8e.js
hxxp://usw29346.com/links/discs-convinces_believing_covered.php

C2 Communications:

the7dda3.com
edge03.net
e5bcf7p.com
404bdf2.com
javadl-esd.sun.com
azpec.com

[sandy2kece]

Malicious URL in the mail

hxxp://4.gbirsk.ru/page9.htm

Redirect:
hxxp://kiladopje.ru:8080/forum/links/column.php

Payload Site IP:
79.98.27.9

C2 Communications:
210.56.23.100:8080