Hello SRH-Lists, Wednesday, April 13, 2005, 1:49:33 PM, you wrote:
SL> I get millions (mil|ions?) of spams from this guy (well, not millions, SL> but I have recieved 15 in the last 2 hours). SL> While generic tests for character/letter obfuscation are difficult, this SL> guy is pretty predictable. SL> body SRH_PENNY2 /(?:e\s*mai\||mi[|l]{2}ions|resu\|ts|wi[|l]{2})/ Pretty good results here: body SRH_PENNY2 /(?:e\s*mai\||mi\|lions|mil\|ions|resu\|ts|wil\|wi\|l)/i score SRH_PENNY2 1 #counts SRH_PENNY2 649s/0h of 293625 corpus (119414s/174211h RM) 04/14/05 Your patterns match only a small fraction of the words I'm currently testing, but it's a really good start for anyone who needs to begin working on these spam before our next SARE rule set file is ready. Bob Menschel