Fake Gmail message: Your Request To Remove Your Account From Gmail.com Server Has Been Approved

No, your gmail account has not been deactivated, this is just another method cybercriminals are using to lure unaware internet users to their malware environments.

The message that is being send:
This is to inform you that your request on: 08/10/2018 2:17:55 p.m. to remove your account from gmail.com server has been approved and will initiate in one hour from the exact time you open this message. Regards. ignore this message to continue with email removal or If this deactivation was not requested by you Please reply us. Regards, Google

Indicator of compromise:

Type Indicator
domain bbcsfxacropolis.com
domain rulemexico.com
email [email protected]
email [email protected]
email [email protected]
email [email protected]
email [email protected]
email [email protected]
FileHash-MD5 0e28a66518e34049ad78c379d4cb6bff
FileHash-MD5 c082e8153828f6496e4c0014cb5ac9d0
FileHash-SHA1 7e7843d28af1ca35ce38e04883bc2d4786ab1095
FileHash-SHA1 eefce307bd3c08cfc34487777af29f8eeda48a4d
FileHash-SHA256 1643a6c83496862708674959b3a5fe0f7700acf0255d8f119b1667ec8ddf4ca2
FileHash-SHA256 53ccae388367560b54b4fb1e2a69db0f6c14b770990c37704ffdd3aadd1602cd
FileHash-SHA256 5d7267316554e9059fab011e206464d88f7795712e0c517dc69f35ff4fe0e839
FileHash-SHA256 914d34a676e93a1730ab4027773f49b3341f2f0e9af06be92c820c435c25552d
FileHash-SHA256 b886c6c8e718571ef1c7031ac6878147d6d28dde05bf1d5c1db618f16aa9d63a
FileHash-SHA256 bda979962890af8c922d8306819fe4d7c5b7d63930d6c80911c43543365996a3
FileHash-SHA256 f575be655ba5e341ef26e37b42fc13a7ecee330cd09cfb46c549851ae2c40b62
FileHash-SHA256 ff82ed912c1ce27680d111fdf6d1eee3b3cb649f4009e8c63175fc367c1c2b16
hostname 27-201.max13.cc.colocall.com
hostname max13.cc.colocall.com
hostname www.ajsia.com
IPv4 62.149.27.201
IPv4 62.149.27.4
URL hxxp://62.149.27.4/
URL hxxp://www.ajsia.com/eng/dove.aspx
URL hxxp://www.ajsia.com/prodotti-copribarba.aspx
URL hxxp://www.ajsia.com/prodotti-cuoco-carta.aspx
URL hxxp://www.ajsia.com/prodotti-guanti-nitrile-g00500.aspx

Reference:

  • otx.alienvault.com/pulse/5b7a2ed01be3cf6a4875ebf1