> I have confirmed compromises from 81.199.0.0/16. Thus far, I've got 81.199.89.139 and 81.199.84.132. > > I'm trying to get some more details as I only have the apache logs from one webmail platform thus far. > > John https://www.cymru.com/nsp-sec/dailyreports/stormworm/list/20080301/as12491.txt shows one of them as Stormworm. -Hank