If you get any mail from this faked domain just bin it it's W32/Netsky.P at mm I have got shed loads of mail from this server from different lists today. sparkes