[Dshield] RE: [TSMalcode] e-card - follow up #4 !

David Kennedy CISSP david.kennedy at acm.org
Tue Nov 5 06:17:58 GMT 2002


At 01:10 PM 11/4/02 -0800, Wayne Beckham wrote:
>My firewall is rejecting any URL with (") parenses in it - and I can't
>seem to browse to those sites, either.  Is there an associated IP
>address for these?  Or is there something else that I'm missing?

You're missing this line in Roger's message:

>
>Uh.... just in case it's not obvious, the string "RemoveThis" is not
>part 
>of the real url.

I repeat:  delete the "RemoveThis" to resolve those URLs.  And to give an
IP address is of limited value because the site owner can more easily lower
the TTL on his DNS for that IP than he can register a new URL and re-send a
variant.

(You wouldn't believe how many bounces we get when we don't obfuscate some
URL and filenames.)



-- 
Regards,

David Kennedy CISSP                         /"\
Director of Research Services,              \ / ASCII Ribbon Campaign
TruSecure Corp. http://www.trusecure.com     X  Against HTML Mail
Protect what you connect;                   / \
Look both ways before crossing the Net.




More information about the list mailing list