Received From: IP 88.222.68.59 (at dokeda.lt / LT-MEGANET) Spamvert: www.legfound.com => botnet legfound.com Resolved to 218.152.22.71 to 58.77.110.212 to 58.233.67.10 to 65.3.134.105 to 67.191.255.83 to 68.34.45.204 to 68.119.114.232 to 69.245.174.253 to 75.64.63.230 to 75.131.212.177 to 76.102.248.125 to 98.204.185.40 to 118.32.144.6 to 118.33.168.97 to 118.37.33.154 to 125.131.0.251 to

An accompanying mail was sent to the following addresses which are thought to be responsible for domain(s), IP blocks, ASN, or nameservers associated with the origin point: abuse@rr.com, postmaster@rr.com Message abstract: Message ID: Originating IP address: 65.33.13.174 (174.13.33.65.cfl.res.rr.com) ASN: 13343 ASN Description: RR-Tampa CIDR: 65.33.0.0/16

>From clientdepmnt.refKN1915459906005.ib@natwest.co.uk Fri Sep 28 03:06:04 2007 Return-Path: <clientdepmnt.refKN1915459906005.ib@natwest.co.uk> Received: from localhost ([192.168.0.3]) by dev.null.davjam.org with ESMTP id <hblq9tvMGG$GBw2L@dev.null.davjam.org> for <dbolt@my-ste.demon.co.uk>; Fri, 28 Sep 2007 03:06:04 +0100 Received: from pop3.demon.co.uk by localhost with POP3 (fetchmail-6

An accompanying mail was sent to the following addresses which are thought to be responsible for domain(s), IP blocks, ASN, or nameservers associated with the origin point: ipmgmt@verizon.com Message abstract: Message ID: Originating IP address: 72.73.250.193 (pool-72-73-250-193.cmdnnj.east.verizon.net) ASN: 19262 ASN Description: Verizon Global Networks

Spam. Unsolicited e-mail report follows: Memo #836450 (4786) Active URLs: http://rbsdigital-id5370575079.rbs.co.uk.soldofo.mo.cn/rbs_onlineform/customercare/form.aspx Dear customer of The Royal Bank of Scotland, RBS Customer Service requests you to complete Digital Banking Online Form. This procedure is obligatory for all