Hi!

I've just wanted to share my rule which is quite effective against spam that contains phrases in the type of
"100 purcant M0ney Back G.u.a.r.a.n.t.e.e" or "|F|R|E|E| B0ttle W0rth Alm0st 60 d0llars!":


rawbody PIPE_DOT_PUNCTUATION            /([a-z][|.]+[a-z].{1,2}){2}/i
describe PIPE_DOT_PUNCTUATION           Body contains punctuation-obfuscated 
text
lang pl describe PIPE_DOT_PUNCTUATION   Tresc zawiera tekst znieksztalcony 
znakami interpunkcyjnymi
score PIPE_DOT_PUNCTUATION              2.5 2.2 2.0 2.0

It catches text where individual letters or pairs of letters are separated with a pipe or dot character.

Any Comments?

Reply via email to