On Monday, October 10, 2005, 8:46:37 PM, Steve wrote: SG> On Oct 10, 2005, at 3:56 PM, Pete McNeil wrote:
>> Though this appears to be one campaign, there are several new >> domains every hour or so and several new variations on their >> obfuscation techniques nearly as often. We continue to add rules >> for all of these variations around the clock - including some >> predictive heuristics which are actually working for quite a bit of >> the traffic. SG> Can't there be a rule written that matches the exact size of the SG> included .gif? I've seen these (if we're talking about the same SG> ones) and the attached gif file is always the same. SG> Just an idea. The campaign I'm referring to as "druglist" does not include any image files. We must be talking about different campaigns. _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
