Date: Tue, 20 Dec 2011 05:42:20 +0300
Subject: Re: Fwd: Re: Scan from a Xerox WorkCentre Pro #2966272
A Document was sent to you using a Xerox WKC1296130.
Sent by: SHIRLEY
Images : 5
Image (.JPEG) Download
cfredret.ru is hosted on 188.8.131.52, exactly the same IP address as this BBB themed malware spam. Blocking access to 184.108.40.206/29 is a fabulous idea if you can.