[SC-Help] Re: They're varying their shields, captain!

[Ellen]

"Lane" <lane at joeandlane.com> wrote in message
news:mailman.23.1117832246.169.spamcop-help at news.spamcop.net...
>
> Today I got one from ip:  205.211.197.142 claiming to be from
> http://www.parefi.net/book.php
>
> I check senderbase at
>
http://www.senderbase.org/?searchBy=ipaddress&sb=1&searchString=205.211.197.142
>
> and I see that this IP volume/magnitude has changed from 1102%/1.7 in the
last
> thirty days to -100%/0.0 in the last day.
>
> So is such a dramatic volume change used in the cipher to calcumalate when
an
> ip is a spammer?
>

I just changed the report routing on that block to inetcontact at amnetus.com
let's see if that makes a difference. I suspect they just have a buncch of
compromised machines down there in Hondurus.

The volume change in SenderBase can mean that someone noticed the machine
was compromised and took it offline or that the worm/trojan got orders to go
quiet for a while or lost contact with the mothership ...

And yes the IP is listed.

Ellen