Alert on web traffic instead of IP Address?

["Isherwood, Jeffrey - AES" <Jeffrey.Isherwood () itt com>]

I have snort rules that are looking for traffic to certain websites, based upon the IP Address of the destination...

However I would like to create a few rules that look for traffic headed to a website that might be using Dynamic DNS 
(or fast flux) and so I do not know the IP Address of the dst host.

For the IP Address alerts I use the following rule:

alert tcp $HOME_NET any -> $MALICIOUS_IP any (msg:"Malicious traffic alert"; flow: established; classtype: 
policy-violation; priority:669; sid:2009072103; rev:2;)

Where $HOME_NET is my internal network and $MALICIOUS_IP is the IP Address of a site that we have deemed to be 
dangerous.  I don't think that I can put a website name in the variables... and with Dynamic DNS and FastFlux changing 
the IPs I can't figure out how to alert on malicious sites being hidden behind the changing IP addresses.

Is it even possible?

________________________________
This e-mail and any files transmitted with it may be proprietary and are intended solely for the use of the individual 
or entity to whom they are addressed. If you have received this e-mail in error please notify the sender.
Please note that any views or opinions presented in this e-mail are solely those of the author and do not necessarily 
represent those of ITT Corporation. The recipient should check this e-mail and any attachments for the presence of 
viruses. ITT accepts no liability for any damage caused by any virus transmitted by this e-mail.

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day 
trial. Simplify your report design, integration and deployment - and focus on 
what you do best, core application coding. Discover what's new with 
Crystal Reports now.  http://p.sf.net/sfu/bobj-july

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users