> > Could you provide a pointer to SOUGH and SOUGH_FRAUD rules? I couldn't > find anything with a quick Google search. But I found some about iXhash. Typo - it should be SOUGHT http://taint.org/2007/08/15/004348a.html matt