In late June 2003, spam-fighters from the news.admin.net-abuse.email Usenet group noticed a particular spammer seemed to be able to move his websites around at will, minute-by-minute. Joe Stewart, GCIH, Senior Intrusion Analyst at LURHQ Corporation, analyzes the Trojan responsible for these dynamically shifting spam servers.