[SC-Help] Re: They're varying their shields, captain!

[Lane]

On Friday 03 June 2005 16:33, Ellen wrote:
> "Lane" <lane at joeandlane.com> wrote in message
> news:mailman.23.1117832246.169.spamcop-help at news.spamcop.net...
>
> > Today I got one from ip:  205.211.197.142 claiming to be from
> > http://www.parefi.net/book.php
> >
> > I check senderbase at
>
> http://www.senderbase.org/?searchBy=ipaddress&sb=1&searchString=205.211.197
>.142
>
> > and I see that this IP volume/magnitude has changed from 1102%/1.7 in the
>
> last
>
> > thirty days to -100%/0.0 in the last day.
> >
> > So is such a dramatic volume change used in the cipher to calcumalate
> > when
>
> an
>
> > ip is a spammer?
>
> I just changed the report routing on that block to inetcontact at amnetus.com
> let's see if that makes a difference. I suspect they just have a buncch of
> compromised machines down there in Hondurus.
>
> The volume change in SenderBase can mean that someone noticed the machine
> was compromised and took it offline or that the worm/trojan got orders to
> go quiet for a while or lost contact with the mothership ...
>
> And yes the IP is listed.
>
> Ellen
>
>
Thanks, Ellen

lane ~"He's not really dead, Jim!"