Re: [botnets] URL formats

[Chris Lee]

hxxp seems to be advantageous for a few reasons:
 1. you can still cut and paste the url
 2. the protocol handlers won't load it up if you accidently click  
on it
 3. you can add a protocol handler for hxxp for whatever you want
 4. easier to recognize domains and patterns (rather than rotted urls)
 5. already widely accepted in spam fighting groups
 6. trivial to do and undo with no exception cases

I figured I'd put down my thoughts to try to help a standard to move  
forward.


On Aug 28, 2008, at 7:07 PM, silky wrote:

On Fri, Aug 29, 2008 at 3:32 AM, Chris Burton <[EMAIL PROTECTED]> wrote:
Hi,
I was wondering if it would be more helpful if we could propose a  
"standard"
for posting broken URLs with some form of start/end indicator to  
allow
easier automated processing from the listings?

I was thinking that it would be nice to post them just rot13'd. Still
trivially decoded (i use leetkey add-in in ff) but not picked up by
indexers/etc. Advantage is that it can still be searched for common
patterns.


ChrisB.


--
noon silky
http://www.themonkeynet.com/armada/
_______________________________________________
botnets@, the public's dumping ground for maliciousness
All list and server information are public and available to law  
enforcement upon request.
http://www.whitestar.linuxbox.org/mailman/listinfo/botnets

_______________________________________________
botnets@, the public's dumping ground for maliciousness
All list and server information are public and available to law enforcement 
upon request.
http://www.whitestar.linuxbox.org/mailman/listinfo/botnets