I have updated this file to include information presented by Dancho Danchev regarding several new RBN IP spaces involved in the recent IFRAME injections: http://doc.emergingthreats.net/pub/Main/SnortConfSamples/RussianBusinessNetworkIPs.txt -- James McQuaid http://www.jamesmcquaid.com