Date: Tue, 20 Dec 2011 05:42:20 +0300
Subject: Re: Fwd: Re: Scan from a Xerox WorkCentre Pro #2966272
A Document was sent to you using a Xerox WKC1296130.
Sent by: SHIRLEY
Images : 5
Image (.JPEG) Download
cfredret.ru is hosted on 126.96.36.199, exactly the same IP address as this BBB themed malware spam. Blocking access to 188.8.131.52/29 is a fabulous idea if you can.