Re: McColo and SPAM

2008-12-06 Thread Eric Brunner-Williams
Paul, I read Gregg Keizer's piece in CW where FireEye's Fengmin Gong is quoted as We have registered a couple hundred domains, Gong said, but we made the decision that we cannot afford to spend so much money to keep registering so many [domain] names. Now interposing on the Srizbi system's

Re: McColo and SPAM

2008-12-06 Thread Neil
'; Skywing Cc: nanog@nanog.org Subject: RE: McColo and SPAM We experienced exactly no decrease with the McColo shut down a few weeks back, even though we receive 2M+ messages per day. It's interesting that each service provider's spam populations are as different as they are. Some experienced

RE: McColo and SPAM

2008-12-06 Thread Paul Kelly :: Blacknight
06, 2008 1:33 PM To: Paul Kelly :: Blacknight Cc: Frank Bulk; 'Peter Serwe'; Skywing; nanog@nanog.org Subject: Re: McColo and SPAM What's very interesting to me is the very rhythmic peaks-and-valleys you show... Seems to go up every day, down during the night; gradually rising mon-wed

Re: McColo and SPAM

2008-12-05 Thread Jeff Shultz
Revolver Onslaught wrote: Hello, Since McColo closed, we noticed the spam was far more intensive than before. However, it seems the amount of spam is similar than than before. Do you feel the same ? Many thanks, RO I've been getting an fair number of e-mails (up from zero) from customers

Re: McColo and SPAM

2008-12-05 Thread Peter Serwe
On Fri, Dec 5, 2008 at 11:34 AM, [EMAIL PROTECTED] wrote: Message: 1 Date: Fri, 05 Dec 2008 20:14:08 +0100 From: Revolver Onslaught [EMAIL PROTECTED] Subject: McColo and SPAM To: nanog [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] Content-Type: text/plain; charset=ISO-8859-1 Hello,

RE: McColo and SPAM

2008-12-05 Thread Skywing
: Re: McColo and SPAM On Fri, Dec 5, 2008 at 11:34 AM, [EMAIL PROTECTED] wrote: Message: 1 Date: Fri, 05 Dec 2008 20:14:08 +0100 From: Revolver Onslaught [EMAIL PROTECTED] Subject: McColo and SPAM To: nanog [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] Content-Type: text/plain; charset=ISO

Re: McColo and SPAM

2008-12-05 Thread Brian Keefer
On Dec 5, 2008, at 12:51 PM, Skywing wrote: McColo hosted the command and control servers for spam botnets and didn't originate spam directly, at least primarily, according to my understanding. - S That is correct. Srizbi and Rustok, primarily. -- bk

Re: McColo and SPAM

2008-12-05 Thread Peter Serwe
originate spam directly, at least primarily, according to my understanding. - S -Original Message- From: Peter Serwe [mailto:[EMAIL PROTECTED] Sent: Friday, December 05, 2008 3:49 PM To: nanog@nanog.org Subject: Re: McColo and SPAM On Fri, Dec 5, 2008 at 11:34 AM, [EMAIL PROTECTED

RE: McColo and SPAM

2008-12-05 Thread Mike Walter
We have not seen any decrease. In the last 24 hours we have seen 3.5 million messages blocked. -Mike -Original Message- From: Revolver Onslaught [mailto:[EMAIL PROTECTED] Sent: Friday, December 05, 2008 2:14 PM To: nanog Subject: McColo and SPAM Hello, Since McColo closed, we noticed

RE: McColo and SPAM

2008-12-05 Thread Raymond Corbin
PM To: Revolver Onslaught; nanog Subject: RE: McColo and SPAM We have not seen any decrease. In the last 24 hours we have seen 3.5 million messages blocked. -Mike -Original Message- From: Revolver Onslaught [mailto:[EMAIL PROTECTED] Sent: Friday, December 05, 2008 2:14 PM To: nanog

Re: McColo and SPAM

2008-12-05 Thread Peter Dambier
Seen behind my ISP (gmx.de), I get almost no spam. Looking into the spam folder I see some 10% of what I used to see. On the other other hand when they closed I got an alarm for my homepage. I got so many wordbooks on my ssh that they exceeded my traffic limit. I had to move my sshd to IPv6 only

RE: McColo and SPAM

2008-12-05 Thread Frank Bulk
just one domain. I know MessageLabs examines spam rates per industry type. Frank -Original Message- From: Peter Serwe [mailto:[EMAIL PROTECTED] Sent: Friday, December 05, 2008 2:57 PM To: Skywing Cc: nanog@nanog.org Subject: Re: McColo and SPAM Certainly, I have seen a perceptual, yet

RE: McColo and SPAM

2008-12-05 Thread Paul Kelly :: Blacknight
Subject: RE: McColo and SPAM We experienced exactly no decrease with the McColo shut down a few weeks back, even though we receive 2M+ messages per day. It's interesting that each service provider's spam populations are as different as they are. Some experienced gigantic decreases, others didn't

Re: McColo and SPAM

2008-12-05 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Fri, Dec 5, 2008 at 11:10 PM, Paul Kelly :: Blacknight [EMAIL PROTECTED] wrote: We saw a dramatic decrease. Attached is our dnsbl mirror in .ie, it mirrors spamhaus amoungst other things. McColo was just an exercise in managing cyber crime