One more followup: We have dramatic evidence of coordination. Please see, for example:
http://www.roaringpenguin.com/canit/reports.php?what=hit-n-run-dom&domain=t-online.de
Log in as "demo" with password "demo"
You can see clusters of machines with each cluster comprising a spam attack. The largest attack was around 2004/04/22 09:11 and involved 21 different machines.
This doesn't neccessarily imply coordination. I've yet to see evidence of anything smart, like blacklisted machines backing off and handing over to another machine. So far, they carry on with delivery attempts, and the other machines attempting to deliver the same spam simply seem to be processing the same list in parallel and ignorant of each other.
Sevo _______________________________________________ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
