On Oct 10, 2005, at 3:56 PM, Pete McNeil wrote:
Though this appears to be one campaign, there are several new domains every hour or so and several new variations on their obfuscation techniques nearly as often. We continue to add rules for all of these variations around the clock - including some predictive heuristics which are actually working for quite a bit of the traffic.
Can't there be a rule written that matches the exact size of the included .gif? I've seen these (if we're talking about the same ones) and the attached gif file is always the same.
Just an idea. Regards, Steve Guluk SGDesign (949) 661-9333 ICQ: 7230769 This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
