Whoops! Just noticed I didn't send this to the list after all... On Fri, 18 Jan 2008, John D. Hardin wrote:
> On Fri, 18 Jan 2008, Loren Wilton wrote: > > > I guess btnl is no longer working. Now they are doing a redirect: > > > > http://google.co.uk///pagead/iclk?sa=l&ai=livermore&num=970&adurl=http://christmas-low-rate.tw?beast > > Combined rule: > > uri GOOG_MALWARE_URI > m,https?://(?:[^\./]+\.)*goo+gle(?:pages)?\.(?:[a-z][a-z][a-z]?(?:\.[a-z][a-z])?)/+.*[?&](?:btni|adurl),i -- John Hardin KA7OHZ http://www.impsec.org/~jhardin/ [EMAIL PROTECTED] FALaholic #11174 pgpk -a [EMAIL PROTECTED] key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 ----------------------------------------------------------------------- Vista "security improvements" consist of attempting to shift blame onto the user when things go wrong. ----------------------------------------------------------------------- Today: John Moses Browning's 153rd Birthday
