>made a connection(or several) to a web site through the firewall. What the link
>scanner is doing is monitoring the high level content of the HTTP data stream
>scanning for known exploits against browser vulnerabilities
sites serving up malware via SSL will be an interesting problem then......