Hi Matthew, i've tried parsing the output of allwhois.com, a few regexps matching emails should work most times. i was more interested in creating statistics (most used attack of the week...) but gave up because of the hassle of manually updating the attack signatures. whats software do you use to determine the (name of the) attack? is there an online database where the URLs, names and further info is not contained within large quantities of text? thanks, tok