[rkangel]

That is the purpose of sinkholes. That's why you don't just change the DNS record to 127.0.0.1 (or similar) - you want to log the traffic that you're seeing so that you know who is infected and can help them.

I'm unaware of this particular international cooperation arrangement but it's great to see.

[jschuur]

Yup. Looks like the system is working pretty well. Plus I'm pretty happy that I've got an explanation for the email I got!