Date: Tue, 20 Dec 2011 05:42:20 +0300
Subject: Re: Fwd: Re: Scan from a Xerox WorkCentre Pro #2966272
A Document was sent to you using a Xerox WKC1296130.
Sent by: SHIRLEY
Images : 5
Image (.JPEG) Download
cfredret.ru is hosted on 184.108.40.206, exactly the same IP address as this BBB themed malware spam. Blocking access to 220.127.116.11/29 is a fabulous idea if you can.