Legitimate sites seem to be nonexistant, although these IP ranges have hosted legitimate sites in the past.
I would personally recommend blocking them all, but if you want to see a fuller analysis of WOT ratings and Google Safe Browsing diagnostics see here*...
Please pay attention to this issue and inform us about your glance as soon as possible.
We graciously ask you to overview the TERMINATION REPORT to meet on this claim -We awaits to your prompt rebound- .
You can see some current nastiness in action at Malware Must Die**.
But there's a second spam run as well, which appears to be similarly themed but using different servers.
The details of the our decision are available for review at a link below.Please pay attention to this question and notify us about your belief as soon as possible.We graciously ask you to visit the ABUSE REPORT to answer on this appeal - We awaits to your prompt answer. These are the malicious domains that I can find on the IPs mentioned, alternatively you can just block: 220.127.116.11 (Gandi, US) 18.104.22.168 (Linode, US) .42 (Silicon Valley Colocation, US) Blocklist: on guuderia .ru: From: [email protected] .linkedin [mailto:[email protected] .linkedin .com] On Behalf Of Donnie Cherry via Linked In Sent: 07 March 2013 Subject: Order N40898 Good afternoon, You can download your Adobe CS4 License here - We encourage you to explore its new and enhanced capabilities with these helpful tips, tutorials, and e Seminars. Adobe Systems Incorporated The malicious payload is at [donotclick]guuderia .ru:8080/forum/links/(report here*) hosted on: .100 (Hetzner, South Africa) 22.214.171.124 (Supermedia, Poland) Blocklist: on gimilako .ru: From: Myspace [mailto:[email protected] .myspace .com] Sent: 07 March 2013 Subject: Your tax return appeal is declined.1960 1300 Spider Veloce, unrestored and partially disassembled. Get a reminder of your name and password Not MEMBER? To use the various functions of the site you need to register first.