herwsx.com - Visa phish

Spam with subject line: "IMPORTANT: Your VISA VbV Password Has Expired!".
Contains links to botnet hosted domain herwsx.com, or more correct, subdomains.

The botnet has earlier (a few days ago) been used in connection with phished/hacked/"social engineered" MSN-accounts which ulitmately led to subdomains of
woooh-i-got-your-pics.com, eg http://zikay.woooh-i-got-your-pics.com/ (now dead).

Maybe more later, but here are some of the IPs, there are of course a lot more.

herwsx.com	 A 	24.7.18.28
herwsx.com	 A 	24.8.113.160
herwsx.com	 A 	24.11.157.140
herwsx.com	 A 	24.57.20.58
herwsx.com	 A 	24.72.35.124
herwsx.com	 A 	24.78.213.116
herwsx.com	 A 	24.91.100.167
herwsx.com	 A 	24.92.91.96
herwsx.com	 A 	24.124.121.27
herwsx.com	 A 	24.126.153.194
herwsx.com	 A 	24.132.37.79
herwsx.com	 A 	24.145.121.232
herwsx.com	 A 	24.156.135.58
herwsx.com	 A 	24.169.239.151
herwsx.com	 A 	24.208.227.190
herwsx.com	 A 	24.215.133.107
herwsx.com	 A 	24.247.10.171
herwsx.com	 A 	62.98.62.150
herwsx.com	 A 	62.216.124.53
herwsx.com	 A 	62.240.83.197
herwsx.com	 A 	64.131.160.249
herwsx.com	 A 	64.149.38.29
herwsx.com	 A 	64.213.220.108
herwsx.com	 A 	65.65.225.167
herwsx.com	 A 	65.75.100.184
herwsx.com	 A 	65.75.126.16
herwsx.com	 A 	65.190.194.187
herwsx.com	 A 	65.255.140.142
herwsx.com	 A 	66.169.46.238
herwsx.com	 A 	67.58.197.15
herwsx.com	 A 	67.77.32.172
herwsx.com	 A 	67.165.108.188
herwsx.com	 A 	67.170.159.74
herwsx.com	 A 	68.37.201.220
herwsx.com	 A 	68.47.158.167
herwsx.com	 A 	68.50.206.125
herwsx.com	 A 	68.63.12.72
herwsx.com	 A 	68.112.23.54
herwsx.com	 A 	68.117.109.49
herwsx.com	 A 	68.122.165.82
herwsx.com	 A 	68.146.131.88
herwsx.com	 A 	68.148.121.25
herwsx.com	 A 	68.167.247.225
herwsx.com	 A 	68.174.232.169
herwsx.com	 A 	68.234.197.192
herwsx.com	 A 	69.70.125.150
herwsx.com	 A 	69.134.253.181
herwsx.com	 A 	69.140.165.16
herwsx.com	 A 	69.246.28.175
herwsx.com	 A 	69.246.207.146
herwsx.com	 A 	69.249.11.217
herwsx.com	 A 	69.250.34.70
herwsx.com	 A 	70.44.39.93
herwsx.com	 A 	70.127.236.229
herwsx.com	 A 	70.245.163.52
herwsx.com	 A 	70.252.150.43
herwsx.com	 A 	71.86.144.65
herwsx.com	 A 	71.104.0.97
herwsx.com	 A 	71.165.92.22
herwsx.com	 A 	71.177.248.231
herwsx.com	 A 	71.205.226.96
herwsx.com	 A 	71.224.204.137
herwsx.com	 A 	71.235.236.26
herwsx.com	 A 	71.236.171.101
herwsx.com	 A 	72.49.110.147
herwsx.com	 A 	72.175.113.58
herwsx.com	 A 	72.183.10.220
herwsx.com	 A 	72.229.48.210
herwsx.com	 A 	72.235.79.145
herwsx.com	 A 	74.64.107.232
herwsx.com	 A 	74.71.27.137
herwsx.com	 A 	74.138.27.173
herwsx.com	 A 	74.140.139.144
herwsx.com	 A 	75.21.108.80
herwsx.com	 A 	75.40.224.209
herwsx.com	 A 	75.42.238.66
herwsx.com	 A 	75.52.166.132
herwsx.com	 A 	75.65.248.156
herwsx.com	 A 	75.83.177.156
herwsx.com	 A 	75.85.80.161
herwsx.com	 A 	75.93.29.165
herwsx.com	 A 	75.140.250.179
herwsx.com	 A 	75.183.168.154
herwsx.com	 A 	75.191.202.85
herwsx.com	 A 	75.199.205.101
herwsx.com	 A 	76.19.9.167
herwsx.com	 A 	76.87.53.128
herwsx.com	 A 	76.107.18.238
herwsx.com	 A 	76.125.26.148
herwsx.com	 A 	76.125.88.172
herwsx.com	 A 	76.168.242.68
herwsx.com	 A 	76.179.242.197
herwsx.com	 A 	76.181.189.184
herwsx.com	 A 	76.187.88.43
herwsx.com	 A 	76.193.118.213
herwsx.com	 A 	76.201.4.209
herwsx.com	 A 	76.228.62.135
herwsx.com	 A 	76.241.95.36
herwsx.com	 A 	77.27.8.166
herwsx.com	 A 	77.127.147.193
herwsx.com	 A 	78.234.248.13
herwsx.com	 A 	78.251.21.128
herwsx.com	 A 	80.108.233.131
herwsx.com	 A 	80.141.187.93
herwsx.com	 A 	80.171.9.244
herwsx.com	 A 	80.171.83.226
herwsx.com	 A 	80.171.84.115
herwsx.com	 A 	80.217.40.15
herwsx.com	 A 	80.217.40.218
herwsx.com	 A 	81.56.143.182
herwsx.com	 A 	81.192.43.199
herwsx.com	 A 	81.222.80.217
herwsx.com	 A 	82.18.186.32
herwsx.com	 A 	82.64.63.171
herwsx.com	 A 	82.66.22.14
herwsx.com	 A 	82.67.161.63
herwsx.com	 A 	82.74.36.150
herwsx.com	 A 	82.143.216.189
herwsx.com	 A 	82.228.241.10
herwsx.com	 A 	82.233.127.188
herwsx.com	 A 	82.243.202.181
herwsx.com	 A 	82.253.34.129
herwsx.com	 A 	82.253.173.222
herwsx.com	 A 	82.254.95.67
herwsx.com	 A 	83.34.66.235
herwsx.com	 A 	83.254.42.53
herwsx.com	 A 	84.62.134.190
herwsx.com	 A 	84.63.156.119
herwsx.com	 A 	84.72.121.195
herwsx.com	 A 	84.73.111.205
herwsx.com	 A 	84.108.166.70
herwsx.com	 A 	84.126.162.19
herwsx.com	 A 	84.228.141.225
herwsx.com	 A 	85.67.55.189
herwsx.com	 A 	85.87.94.237
herwsx.com	 A 	85.196.204.112
herwsx.com	 A 	85.224.23.122
herwsx.com	 A 	85.250.192.10
herwsx.com	 A 	86.22.0.212
herwsx.com	 A 	87.59.123.230
herwsx.com	 A 	88.132.3.183
herwsx.com	 A 	88.178.106.104
herwsx.com	 A 	88.189.116.147
herwsx.com	 A 	89.186.102.72
herwsx.com	 A 	89.195.134.104
herwsx.com	 A 	89.230.53.106
herwsx.com	 A 	90.41.99.15
herwsx.com	 A 	90.42.17.234
herwsx.com	 A 	90.146.87.18
herwsx.com	 A 	92.41.208.170
herwsx.com	 A 	92.254.231.25
herwsx.com	 A 	93.172.81.94
herwsx.com	 A 	94.189.196.48
herwsx.com	 A 	94.196.34.28
herwsx.com	 A 	94.253.195.96
herwsx.com	 A 	95.28.26.211
herwsx.com	 A 	95.85.176.83
herwsx.com	 A 	95.176.170.199
herwsx.com	 A 	95.221.5.248
herwsx.com	 A 	97.80.185.84
herwsx.com	 A 	98.28.85.41
herwsx.com	 A 	98.101.80.66
herwsx.com	 A 	98.195.151.33
herwsx.com	 A 	98.203.203.141
herwsx.com	 A 	98.218.143.210
herwsx.com	 A 	99.92.53.233
herwsx.com	 A 	99.155.37.236
herwsx.com	 A 	99.233.128.7
herwsx.com	 A 	99.236.138.199
herwsx.com	 A 	99.253.12.49
herwsx.com	 A 	112.200.76.197
herwsx.com	 A 	114.59.43.255
herwsx.com	 A 	114.59.187.24
herwsx.com	 A 	116.111.190.68
herwsx.com	 A 	116.206.132.170
herwsx.com	 A 	116.206.166.20
herwsx.com	 A 	121.73.136.182
herwsx.com	 A 	121.91.168.179
herwsx.com	 A 	124.180.165.16
herwsx.com	 A 	125.212.164.190
herwsx.com	 A 	138.210.154.36
herwsx.com	 A 	142.162.6.200
herwsx.com	 A 	147.174.13.234
herwsx.com	 A 	151.53.88.201
herwsx.com	 A 	151.203.75.171
herwsx.com	 A 	157.252.179.242
herwsx.com	 A 	173.17.189.162
herwsx.com	 A 	173.19.26.252
herwsx.com	 A 	173.21.76.39
herwsx.com	 A 	173.28.55.189
herwsx.com	 A 	173.33.108.174
herwsx.com	 A 	173.35.201.155
herwsx.com	 A 	174.50.132.75
herwsx.com	 A 	189.79.76.65
herwsx.com	 A 	190.46.169.216
herwsx.com	 A 	190.53.29.75
herwsx.com	 A 	190.213.30.49
herwsx.com	 A 	199.76.148.197
herwsx.com	 A 	201.244.169.83
herwsx.com	 A 	201.255.106.121

The server state is: 401 record limit exceeded