bounce@news.forbrukerhuset.com

Posted on the behalf of the victim.

Email:

From: Withdraw request <info@news.forbrukerhuset.com>
To:
Cc:
Bcc:
Date: Sun, 08 Oct 2017
Subject: You have remaining funds in your account, xxx@xxx.com

Your account is open again
Dear xxx

We have noticed that your account has been disabled since 11/20/2016.
We solved the problem and you now have access to the account again.
Account name: xxx@xxx.com
Account value: AUD 867.00
Frequently asked questions:

I can not remember my login information. What do I do?

If you do not remember your login information, you must create an account with your email xxx@xxx.com

After you create a new account, the amount above will automatically be transferred to your new account.

Create a new account

Malware link hidden in the message: http: // news.forbrukerhuset.com /4902/eyJpZENsaSI6IjY4NSIsImlkQ2FtcCI6Mjg5MzYxNiwiY29kIjoxNTkzOTQ3MTEsImNhdCI6IiIsImNudCI6IkdCUiIsImxpc3QiOiJsaXN0X0FVMl9CYXRjaF9NYXkxNyIsImVtYWlsIjoibWljaGFlbEBkaWFsaXguY29tLmF1In0

X-From_: bounce@news.forbrukerhuset.com Sun Oct 8 2017
Return-Path: <bounce@news.forbrukerhuset.com>
Message-ID: <20171008032520.406855028993616005@news.forbrukerhuset.com>
Date: Sun, 08 Oct 2017
Subject: =?UTF-8?B?WW91IGhhdmUgcmVtYWluaW5nIGZ1bmRzIGluIHlvdXIgYWNjb3VudCwgbWljaGFlbEBkaWFsaXguY29tLmF1?=
From: Withdraw request <info@news.forbrukerhuset.com>
Reply-To: info@forbrukerhuset.com
To:
List-Unsubscribe: mailto: info@forbrukerhuset.com

According to VirusTotal, the link is used in spreading malware.