On Wed, 29 Nov 2006, Loren Wilton wrote: > > for mangled viagra and other stuff ..is there any simple rule?? > > such as following text... > > Mangled rules are never simple rules.
I have a perl script that will take a word list and generate REs for obfuscated versions of those words. http://www.impsec.org/~jhardin/antispam Examples: # cialas @ 3.0 describe OBFU_WRD_021 obfuscated "cialas" body OBFU_WRD_021 /\b(?!cialas)(?:(?:(?:[c\xA2\xA9\xAB\xC7\xE7]|&\#(?:67|99);){1,2}['\.~"*^]?(?:[i!l1j\|\/\xA1\xCC-\xCF\xEC-\xEF]|&i[a-z]+;){1,2}['\.~"*^]?(?:[EMAIL PROTECTED]|\/\\|&a[a-z]+;){1,2}['\.~"*^]?(?:[l1i!\|\xCC-\xCF]|(\|_)|&\#(?:76|108);){1,2}['\.~"*^]?(?:[EMAIL PROTECTED]|\/\\|&a[a-z]+;){1,2}['\.~"*^]?(?:[s5z\$\xA6\xA7\xA8]|&\#(?:83|115);))|(?:c\s?i\s?a\s?l\s?a\s?s))/i score OBFU_WRD_021 3.0 # cialis @ 3.0 describe OBFU_WRD_022 obfuscated "cialis" body OBFU_WRD_022 /\b(?!cialis)(?:(?:(?:[c\xA2\xA9\xAB\xC7\xE7]|&\#(?:67|99);){1,2}['\.~"*^]?(?:[i!l1j\|\/\xA1\xCC-\xCF\xEC-\xEF]|&i[a-z]+;){1,2}['\.~"*^]?(?:[EMAIL PROTECTED]|\/\\|&a[a-z]+;){1,2}['\.~"*^]?(?:[l1i!\|\xCC-\xCF]|(\|_)|&\#(?:76|108);){1,2}['\.~"*^]?(?:[i!l1j\|\/\xA1\xCC-\xCF\xEC-\xEF]|&i[a-z]+;){1,2}['\.~"*^]?(?:[s5z\$\xA6\xA7\xA8]|&\#(?:83|115);))|(?:c\s?i\s?a\s?l\s?i\s?s))/i score OBFU_WRD_022 3.0 # levitra @ 3.0 describe OBFU_WRD_089 obfuscated "levitra" body OBFU_WRD_089 /\b(?!levitra)(?:(?:(?:[l1i!\|\xCC-\xCF]|(\|_)|&\#(?:76|108);){1,2}['\.~"*^]?(?:[e3\xBC\xBD\xC6\xC8-\xCB\xE6\xE8-\xEB]|&e[a-z]+;){1,2}['\.~"*^]?(?:v|(\\\/)|&\#(?:86|118);){1,2}['\.~"*^]?(?:[i!l1j\|\/\xA1\xCC-\xCF\xEC-\xEF]|&i[a-z]+;){1,2}['\.~"*^]?(?:[t\xA3\xB1]|&\#(?:84|116);){1,2}['\.~"*^]?(?:r|&\#(?:82|114);){1,2}['\.~"*^]?(?:[EMAIL PROTECTED]|\/\\|&a[a-z]+;))|(?:l\s?e\s?v\s?i\s?t\s?r\s?a))/i score OBFU_WRD_089 3.0 # viagra @ 2.5 describe OBFU_WRD_184 obfuscated "viagra" body OBFU_WRD_184 /\b(?!viagra)(?:(?:(?:v|(\\\/)|&\#(?:86|118);){1,2}['\.~"*^]?(?:[i!l1j\|\/\xA1\xCC-\xCF\xEC-\xEF]|&i[a-z]+;){1,2}['\.~"*^]?(?:[EMAIL PROTECTED]|\/\\|&a[a-z]+;){1,2}['\.~"*^]?(?:[gq]|&\#(?:71|103);){1,2}['\.~"*^]?(?:r|&\#(?:82|114);){1,2}['\.~"*^]?(?:[EMAIL PROTECTED]|\/\\|&a[a-z]+;))|(?:v\s?i\s?a\s?g\s?r\s?a))/i score OBFU_WRD_184 2.5 -- John Hardin KA7OHZ http://www.impsec.org/~jhardin/ [EMAIL PROTECTED] FALaholic #11174 pgpk -a [EMAIL PROTECTED] key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 ----------------------------------------------------------------------- "Bother," said Pooh as he struggled with /etc/sendmail.cf, "it never does quite what I want. I wish Christopher Robin was here." -- Peter da Silva in a.s.r ----------------------------------------------------------------------- 26 days until Christmas
