# SARE Obfuscation Ruleset for SpamAssassin -- file 0 # Version: 01.00.14 # Created: 2005-05-02 # Modified: 2007-06-05 # Usage instructions and documentation in 70_sare_obfu0.cf # Full Revision History / Change Log in 70_sare_obfu.log #@@# 01.00.08: Oct 01 2005 #@@# Minor score updates based on additional mass-check #@@# Moved file 0 to file 1: SARE_OBFU_ALWAYS #@@# Moved file 0 to file 1: SARE_OBFU_CIALIS #@@# Moved file 0 to file 1: SARE_OBFU_CREDIT_POX #@@# Moved file 0 to file 1: SARE_OBFU_GOALS #@@# Moved file 0 to file 1: SARE_OBFU_ORDERING_SPL #@@# Moved file 0 to file 1: SARE_OBFU_RELIABLE #@@# Moved file 0 to file 1: SARE_OBFU_RESULTING #@@# Moved file 0 to file 1: SARE_OBFU_SOMA #@@# Moved file 0 to file 1: SARE_OBFU_STOCKS #@@# Moved file 0 to file x31: SARE_OBFU_AFFORD #@@# Moved file 2 to file 0: SARE_OBFU_PRESENTLY #@@# Removed rule for SA 3.2: SARE_OBFU_XANAX #@@# Removed rule for SA 3.2: SARE_OBFU_MEDS2 #@@# Removed rule for SA 3.2: SARE_OBFU_TBL* #@@# Removed rule for SA 3.2: OBFU_PRESCR_SPL1 #@@# Removed rule for SA 3.2: SARE_OBFU_VICODIN #@@# Removed rule for SA 3.2: SARE_OBFU_GUARANTEE # License: Artistic - see http://www.rulesemporium.com/license.txt # Current Maintainer: Doc Schneider - maddoc@maddoc.net # Past Maintainer: Bob Menschel - RMSA@Menschel.net # Current Home: http://www.rulesemporium.com/rules/70_sare_obfu0.cf # # Usage: This family of files, 70_sare_obfu*.cf, contain rules that test for common # types of obfuscation, and for commonly obfuscated words in subject headers and email bodies. # # Note: As of version 00.01.00, 2005-04-30, Only files obfu0.cf and obfu1.cf exist. # Testing of additional words is on-going, and we expect these files/rules to grow quickly. # # WARNING: As with many obfuscation rules and files, many of the rules in this family are # language-dependent, most specifically English-dependent, and in some areas, American-dependent. # Be very careful if applying any of these files on systems where large numbers of emails are non-English. # And if/when you find non-spam that hits these rules, please send copies to SARE so we can adjust our scores. # # WARNING # 2: Despite our best efforts at keeping the performance impact within reason, these rules files # WILL slow down your email processing. Systems that are tight on resources, or that have trouble keeping # up with the email flow, will want to think twice or thrice. # # File 0: 70_sare_obfu0.cf -- These are obfuscation rules that hit at least 10 spam and no ham. # While SARE cannot guarantee they never will hit ham, they have not hit ham in any SARE # mass-check, against tens of thousands of ham. This is a rules file we expect any/all # email systems using SpamAssassin to benefit from. # Note! Some of these rules WILL hit ham, if words in ham are misspelled in just the right way. # We cannot tell you that it won't happen -- all we can say is that WE haven't seen those # misspellings yet. Fortunately, we see from our experience that ham should not have more than # one such misspelling in any one email. Therefore even a rule score of 1.666 should not cause # any email to be flagged as spam unless it starts out as a very spammy ham. # # File 1: 70_sare_obfu1.cf -- These are obfuscation rules that meet one of the follow criteria: # a) Rules that do, or in the past have hit ham during SARE mass-check tests # b) Rules that hit no ham and currently do not hit more than 10 spam in any single mass-check run. # If the rules hit ham, they hit at last 10 spam to each 1 ham. # With few exceptions these rules score significantly less than the rules in file 0. # Systems which are very sensitive to false positives and/or need to be very careful about resource # use may want to exclude this ruleset, pick and choose among its rules, or lower their scores. # Systems that use this file 1 should ALSO use file 0. # # File 2: 70_sare_obfu2.cf -- These obfuscation rules hit no spam at this time, but they are considered # "safe" rules that should never hit ham. # These are primarily rules that test for specific words seen only in spam, or similar types of # "pretty darn sure" rules. # Systems which are very sensitive to SpamAssassin overhead may want to exclude this ruleset file to # avoid its overhead, but systems with plenty of resources that want to be aggressive against spam # may benefit from this ruleset file. # # File 3: 70_sare_obfu3.cf -- These are obfuscation rules that hit a significant amount of spam, but also # hit a significant amount of hm during SARE mass-check tests. # Systems which are very sensitive to false positives or to SA resource usage should NOT install this ruleset. # # File 4: 70_sare_obfu4.cf -- These are obfuscation rules that meet one of the following criteria: # a) They hit over 100 ham during SARE mass-check tests, but still hit enough spam to be worth while to aggressively anti-spam systems. # b) They hit no emails at this time, but have been recommended by anti-spam sources (such as rules developed from Spam-L list reports). # They seem riskier than the no-hit rules we put into file 2. # Again, systems which are very sensitive to false positives or to SA resource usage should NOT install this ruleset. # # eng: 70_sare_obfu_eng.cf -- These are obfuscation rules which work well within the English language, but are liable to cause false # positives in other languages. They include rules which test for letter combinations and encoded header headers. Systems that # receive ham in languages other than English should NOT use this file. # # arc: 70_sare_obfu_arc.cf -- These are obfuscation rules that once were published in other files, but which have since lost all value. # They either hit too much ham (without hitting enough spam to make it worth while), or they don't hit any spam. # SARE regularly runs mass-checks on these rules to see if any of them are worth reviving, but # we expect that nobody will be running these rules in any production system. ######## ###################### ################################################## # Rules renamed or moved ######## ###################### ################################################## meta SARE_OBFU_ALWAYS 0 meta SARE_OBFU_CIALIS 0 meta SARE_OBFU_CREDIT_POX 0 meta SARE_OBFU_GOALS 0 meta SARE_OBFU_ORDERING_SPL 0 meta SARE_OBFU_RELIABLE 0 meta SARE_OBFU_RESULTING 0 meta SARE_OBFU_SOMA 0 meta SARE_OBFU_STOCKS 0 meta SARE_OBFU_AFFORD 0 ######## ###################### ################################################## # Technical Obfuscations ######## ###################### ################################################## full SARE_OBFU_AMP2B m'(?:(?!http://)h.?t.?t.?p.?:.?/.?/)[^/\?]{4,40}\&'is describe SARE_OBFU_AMP2B invalid character within URI host/domain score SARE_OBFU_AMP2B 2.555 #hist SARE_OBFU_AMP2B Bob Menschel, June 4 2005 from idea posted by Alex Broens #counts SARE_OBFU_AMP2B 369s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_AMP2B 4945s/0h of 271461 corpus (129860s/141601h RM) 06/12/05 #counts SARE_OBFU_AMP2B 8s/0h of 5638 corpus (1019s/4619h ft) 06/04/05 #counts SARE_OBFU_AMP2B 3s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_AMP2B 0s/0h of 325 corpus (279s/46h CT) 06/04/05 full SARE_OBFU_CONTENT01 /Content-Type: ;text\/plain;/ describe SARE_OBFU_CONTENT01 Obfuscation via content-type header score SARE_OBFU_CONTENT01 2.500 #stype SARE_OBFU_CONTENT01 obfu #hist SARE_OBFU_CONTENT01 Frederic Tarasevicius, May 26, 2005 #counts SARE_OBFU_CONTENT01 19s/0h of 619677 corpus (318875s/300802h RM) 09/11/05 #max SARE_OBFU_CONTENT01 207s/0h of 275081 corpus (134226s/140855h RM) 05/30/05 #counts SARE_OBFU_CONTENT01 1s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_CONTENT01 85s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_OBFU_CONTENT01 0s/0h of 47845 corpus (43810s/4035h MY) 05/28/05 body SARE_OBFU_DRUGDOL1_SPC m{\$1\.\s+\$1\.\s+\$1\.\s+}i describe SARE_OBFU_DRUGDOL1_SPC found apparent obfuscation of word used in spam score SARE_OBFU_DRUGDOL1_SPC 2.333 #stype SARE_OBFU_DRUGDOL1_SPC spamp #counts SARE_OBFU_DRUGDOL1_SPC 261s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_DRUGDOL1_SPC 1s/0h of 10829 corpus (6367s/4462h CT) 05/08/05 #counts SARE_OBFU_DRUGDOL1_SPC 105s/0h of 45520 corpus (41534s/3986h MY) 05/16/05 #counts SARE_OBFU_DRUGDOL1_SPC 4s/0h of 4677 corpus (810s/3867h ft) 05/28/05 body SARE_OBFU_GPIL_TAG m{>G\s+P[-_`~!^&*()=+'";:?.,]?I[-_`~!^&*()=+'";:?.,]?L<}i describe SARE_OBFU_GPIL_TAG found apparent obfuscation of word used in spam score SARE_OBFU_GPIL_TAG 1.666 #stype SARE_OBFU_GPIL_TAG spamp #counts SARE_OBFU_GPIL_TAG 95s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_GPIL_TAG 983s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_GPIL_TAG 0s/0h of 10829 corpus (6367s/4462h CT) 05/08/05 #counts SARE_OBFU_GPIL_TAG 0s/0h of 46903 corpus (42982s/3921h MY) 05/09/05 #counts SARE_OBFU_GPIL_TAG 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 rawbody __SARE_OBFU_SPLIT_HR1A /href=\"[^"]*\r[^\n]/is full __SARE_OBFU_SPLIT_HR1B /href=\"[^"]*\r[^\n]/is meta SARE_OBFU_SPLIT_HR1 __SARE_OBFU_SPLIT_HR1A || __SARE_OBFU_SPLIT_HR1B score SARE_OBFU_SPLIT_HR1 2.500 #stype SARE_OBFU_SPLIT_HR1 obfu describe SARE_OBFU_SPLIT_HR1 unescaped cr in uri #hist SARE_OBFU_SPLIT_HR1 Loren Wilton #counts SARE_OBFU_SPLIT_HR1 13s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_SPLIT_HR1 49s/0h of 292007 corpus (122219s/169788h RM) 04/27/05 #counts SARE_OBFU_SPLIT_HR1 0s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_SPLIT_HR1 11s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_OBFU_SPLIT_HR1 781s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 ######## ###################### ################################################## # Numerical Obfuscations ######## ###################### ################################################## body SARE_OBFU_NUMS2 /\d,0OO/i describe SARE_OBFU_NUMS2 Obfuscation involving numbers score SARE_OBFU_NUMS2 1.666 #hist SARE_OBFU_NUMS2 Fred Tarasevicius, May 2005 #counts SARE_OBFU_NUMS2 183s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_NUMS2 12s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_NUMS2 2s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_NUMS2 11s/0h of 4650 corpus (807s/3843h ft) 05/27/05 body SARE_OBFU_NUMS3a /\doo[o0] d[o0][l|][l|]ars/i describe SARE_OBFU_NUMS3a Obfuscation involving numbers score SARE_OBFU_NUMS3a 0.967 #hist SARE_OBFU_NUMS3a Fred Tarasevicius, May 2005 #counts SARE_OBFU_NUMS3a 8s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_NUMS3a 53s/0h of 261031 corpus (115925s/145106h RM) 05/29/05 #counts SARE_OBFU_NUMS3a 10s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_NUMS3a 1s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_NUMS3a 10s/0h of 4650 corpus (807s/3843h ft) 05/27/05 body SARE_OBFU_NUMS3b /\do[o0][o0] d[o0][l|][l|]ars/i describe SARE_OBFU_NUMS3b Obfuscation involving numbers score SARE_OBFU_NUMS3b 1.278 #hist SARE_OBFU_NUMS3b Fred Tarasevicius, May 2005 #counts SARE_OBFU_NUMS3b 18s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_NUMS3b 103s/0h of 261031 corpus (115925s/145106h RM) 05/29/05 #counts SARE_OBFU_NUMS3b 13s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_NUMS3b 3s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_NUMS3b 17s/0h of 4650 corpus (807s/3843h ft) 05/27/05 body SARE_OBFU_NUMS3c /\d[o0][o0]o d[o0][l|][l|]ars/i describe SARE_OBFU_NUMS3c Obfuscation involving numbers score SARE_OBFU_NUMS3c 1.261 #hist SARE_OBFU_NUMS3c Fred Tarasevicius, May 2005 #counts SARE_OBFU_NUMS3c 13s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_NUMS3c 94s/0h of 258068 corpus (113628s/144440h RM) 05/27/05 #counts SARE_OBFU_NUMS3c 14s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_NUMS3c 5s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_NUMS3c 14s/0h of 4650 corpus (807s/3843h ft) 05/27/05 body SARE_OBFU_NUMS3d /\d[o0]o[o0] d[o0][l|][l|]ars/i describe SARE_OBFU_NUMS3d Obfuscation involving numbers score SARE_OBFU_NUMS3d 1.367 #hist SARE_OBFU_NUMS3d Fred Tarasevicius, May 2005 #counts SARE_OBFU_NUMS3d 16s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_NUMS3d 108s/0h of 258068 corpus (113628s/144440h RM) 05/27/05 #counts SARE_OBFU_NUMS3d 19s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_NUMS3d 4s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_NUMS3d 15s/0h of 4650 corpus (807s/3843h ft) 05/27/05 ######## ###################### ################################################## # Single Word Obfuscations (alphabetically) ######## ###################### ################################################## body SARE_OBFU_BACK_NUM m'(?!BACK)\bb\d?a\d?c\d?k\b'i describe SARE_OBFU_BACK_NUM found apparent obfuscation of word used in spam score SARE_OBFU_BACK_NUM 1.666 #counts SARE_OBFU_BACK_NUM 125s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_BACK_NUM 416s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_BACK_NUM 76s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_BACK_NUM 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_BACK_NUM 0s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_BACK_NUM 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_BUY_SUB Subject =~ /(?:^\s*bu\Wy |\bbvy\b)/i describe SARE_OBFU_BUY_SUB subject has obfuscated spammer topic score SARE_OBFU_BUY_SUB 3.333 #stype SARE_OBFU_BUY_SUB obfu #hist SARE_OBFU_BUY_SUB Created by Bob Menschel Aug 5 2004 #hist SARE_OBFU_BUY_SUB Two similar but different rules merged, May 27 2005 #counts SARE_OBFU_BUY_SUB 100s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_BUY_SUB 199s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_OBFU_BUY_SUB 6s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_OBFU_BUY_SUB 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_OBFU_BUY_SUB 8s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_BUY_SUB 2s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_BUY_SUB 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_BUY_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_CHEAP_SUB Subject =~ /(?!cheap(er)?)\b(?:c.?h.?e.?a.?p.?(?:e.?r)?|[c\xC7\xE7\xA2\xA9][\W_]?h[\W_]?[e3\*\xC8-\xCB\xE8-\xEB][\W_]?[a4\*\@\xC0-\xC5\xAA\xE0-\xE5][\W_]?p([e3\*\xC8-\xCB\xE8-\xEB][\W_]?[r\xAE])?)/i describe SARE_OBFU_CHEAP_SUB subject has obfuscated spammer topic score SARE_OBFU_CHEAP_SUB 3.333 #stype SARE_OBFU_CHEAP_SUB obfu #counts SARE_OBFU_CHEAP_SUB 49s/0h of 619677 corpus (318875s/300802h RM) 09/11/05 #max SARE_OBFU_CHEAP_SUB 338s/0h of 400345 corpus (178117s/222228h RM) 03/31/05 #counts SARE_OBFU_CHEAP_SUB 57s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_OBFU_CHEAP_SUB 21s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_CHEAP_SUB 55s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_CHEAP_SUB 4s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_CHEAP_SUB 22s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_CHEAP_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_CLICK_NUM m'(?!click)\bc\d?l\d?i\d?c\d?k(?:\d?(?:e\d?d|i\d?n\d?g|s))?\b'i describe SARE_OBFU_CLICK_NUM found apparent obfuscation of word used in spam score SARE_OBFU_CLICK_NUM 2.222 #hist SARE_OBFU_CLICK_NUM More generalized obfu click attempted May 1 2005, hit 1186s/6h #counts SARE_OBFU_CLICK_NUM 493s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_CLICK_NUM 1011s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_CLICK_NUM 207s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_CLICK_NUM 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_CLICK_NUM 0s/0h of 10828 corpus (6369s/4459h CT) 05/02/05 #counts SARE_OBFU_CLICK_NUM 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 #counts SARE_OBFU_CLICK_NUM 67s/0h of 45520 corpus (41534s/3986h MY) 05/16/05 body SARE_OBFU_CONFLICT m'(?!CONFLICT(?:s|ing)?)\bc+[o0]+[nñ]+f+[l\|]+[i1l\|]+c+t+(?:s+|[i1l\|]+[nñ]+[g69]+)?\b'i describe SARE_OBFU_CONFLICT found apparent obfuscation of word used in spam score SARE_OBFU_CONFLICT 1.666 #counts SARE_OBFU_CONFLICT 154s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_CONFLICT 307s/0h of 295111 corpus (124249s/170862h RM) 04/19/05 #counts SARE_OBFU_CONFLICT 145s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_CONFLICT 0s/0h of 41487 corpus (37599s/3888h MY) 04/18/05 #counts SARE_OBFU_CONFLICT 8s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_CONFLICT 93s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_CONFLICT 4s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_ESTABLISH_PX m{(?!ES-?T-?AB-?LISH(?:ES|ED|ING)?)E[-_`~!^&*()=+'";:?.,]?S[-_`~!^&*()=+'";:?.,]?T[-_`~!^&*()=+'";:?.,]?A[-_`~!^&*()=+'";:?.,]?B[-_`~!^&*()=+'";:?.,]?L[-_`~!^&*()=+'";:?.,]?I[-_`~!^&*()=+'";:?.,]?S[-_`~!^&*()=+'";:?.,]?H(?:[-_`~!^&*()=+'";:?.,]?(?:E[-_`~!^&*()=+'";:?.,]?[SD]|I[-_`~!^&*()=+'";:?.,]?N[-_`~!^&*()=+'";:?.,]?G))?\b}i describe SARE_OBFU_ESTABLISH_PX found apparent obfuscation of word used in spam score SARE_OBFU_ESTABLISH_PX 2.222 #hist SARE_OBFU_ESTABLISH_PX Bob Menschel, Apr 23 2005 #hist SARE_OBFU_ESTABLISH_PX Added exclusions for hyphenation, found in ham #counts SARE_OBFU_ESTABLISH_PX 16s/0h of 619677 corpus (318875s/300802h RM) 09/11/05 #max SARE_OBFU_ESTABLISH_PX 1291s/0h of 274568 corpus (109718s/164850h RM) 05/09/05 #counts SARE_OBFU_ESTABLISH_PX 0s/0h of 43978 corpus (40095s/3883h MY) 05/01/05 #counts SARE_OBFU_ESTABLISH_PX 3s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_ESTABLISH_PX 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_HERE_NUM m'(?!here)\bh\d?e\d?r\d?e\b'i describe SARE_OBFU_HERE_NUM found apparent obfuscation of word used in spam score SARE_OBFU_HERE_NUM 2.222 #counts SARE_OBFU_HERE_NUM 617s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_HERE_NUM 1429s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_HERE_NUM 283s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_HERE_NUM 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_HERE_NUM 2s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_HERE_NUM 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_HYDROCODONE m'(?!HYDROCODONE)h+y+d+r+[o0]+c+[o0]+d+[o0]+[nñ]+[e3]+'i describe SARE_OBFU_HYDROCODONE found apparent obfuscation of word used in spam score SARE_OBFU_HYDROCODONE 1.666 #counts SARE_OBFU_HYDROCODONE 1s/0h of 619677 corpus (318875s/300802h RM) 09/11/05 #max SARE_OBFU_HYDROCODONE 394s/0h of 293625 corpus (119414s/174211h RM) 04/14/05 #counts SARE_OBFU_HYDROCODONE 66s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_HYDROCODONE 0s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_HYDROCODONE 6s/0h of 41487 corpus (37599s/3888h MY) 04/18/05 #counts SARE_OBFU_HYDROCODONE 2s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_HYDROCODONE 26s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_HYDROCODONE 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_MATERIALLY m'(?!materiaa?l(?:ly)?)\b(?:m|rn)+(?:[a\@4åä]|/\\)+t+[e3]+r+[i1l\|]+(?:[a\@4åä]|/\\)+[l\|]+(?:[l\|]+y+)?\b'i describe SARE_OBFU_MATERIALLY found apparent obfuscation of word used in spam score SARE_OBFU_MATERIALLY 1.666 #hist SARE_OBFU_MATERIALLY Aug 2005: Allow materiaal as used in Norwegian email #counts SARE_OBFU_MATERIALLY 148s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_MATERIALLY 435s/0h of 295111 corpus (124249s/170862h RM) 04/19/05 #counts SARE_OBFU_MATERIALLY 241s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_MATERIALLY 0s/0h of 41487 corpus (37599s/3888h MY) 04/18/05 #counts SARE_OBFU_MATERIALLY 10s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_MATERIALLY 95s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_MATERIALLY 4s/0h of 2202 corpus (356s/1846h ft) 05/16/05 #body __SARE_OBFU_MEDS1 /(?!medications)\bm[eÈÉÊËèéêë3][dÐ][iÌÍÎÏìíîï\|1l\!][cÇ\(][aÀÁÂÃÄÅàáâãäå4\@][t+7][iÌÍÎÏìíîï\|1l\!][oÒÓÔÕÖòóôõöøðØ0][nÑñ][sz5\$]\b/i #body __SARE_OBFU_MEDS2 /(?!\bmedications?\b)(?:\b(m)(?:\1){0,2}|\B(rn|\/V\\|\/\\\/\\|\xCE\x9C|\xD0\x9C|\xD0\xBC)(?:\2){0,2})[\W\d_]?([e3\*ý-ýý-ý]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)(?:\3){0,2}[\W\d_]?([dý]|\xC4[\x8E-\x91])(?:\4){0,2}[\W\d_]?([il1:\|\*ý-ýý-ýý]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)(?:\5){0,2}[\W\d_]?([c\*ýýýý]|\xC4[\x86-\x8D]|\xD0\xA1|\xD1\x81)(?:\6){0,2}[\W\d_]?([a4\*\@ý-ýýý-ý]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)(?:\7){0,2}[\W\d_]?([t\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)(?:\8){0,2}[\W\d_]?([il1:\|\*ý-ýý-ýý]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)(?:\9){0,2}[\W\d_]?([o0\*ýýýýý-ýý-ý]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)(?:\10){0,2}[\W\d_]?([nýý]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)(?:\11){0,2}[\W\d_]?(?:([s5\$ý]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)(?:\12){0,2})?\b/i #body __SARE_OBFU_MEDS3 /\bmediz\b/ #meta SARE_OBFU_MEDS __SARE_OBFU_MEDS1 || __SARE_OBFU_MEDS2 || __SARE_OBFU_MEDS3 #describe SARE_OBFU_MEDS found apparent obfuscation of word used in spam #score SARE_OBFU_MEDS 2.777 #hist SARE_OBFU_MEDS __SARE_OBFU_MEDS1 originally J_3L33T_MEDCTN by Jennifer Wheeler #hist SARE_OBFU_MEDS __SARE_OBFU_MEDS2 by Bob Menschel, Apr 2005 #hist SARE_OBFU_MEDS __SARE_OBFU_MEDS3 by Bob Menschel, Aug 2005 #overlap SARE_OBFU_MEDS Replaces (does better than) Jennifer Wheeler's J_3L33T_MEDCTN and Bob's RM_bwm_medication #counts SARE_OBFU_MEDS 6094s/2h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_MEDS 473s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_MEDS 58s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_MEDS 41s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_MEDS 161s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_MEDS 3s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #body SARE_OBFU_MEDS2_NUM m'(?!MEDS)\bM\d?E\d?D\d?S\b'i #describe SARE_OBFU_MEDS2_NUM found apparent obfuscation of word used in spam #score SARE_OBFU_MEDS2_NUM 1.666 #counts SARE_OBFU_MEDS2_NUM 140s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_MEDS2_NUM 351s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_MEDS2_NUM 59s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_MEDS2_NUM 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_MEDS2_NUM 0s/0h of 10828 corpus (6369s/4459h CT) 05/02/05 #counts SARE_OBFU_MEDS2_NUM 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_MORTGAGE_POX m{(?!mortgage)\bm[-_`~!^&*()=+'";:?.,]?o[-_`~!^&*()=+'";:?.,]?r[-_`~!^&*()=+'";:?.,]?t[-_`~!^&*()=+'";:?.,]?g[-_`~!^&*()=+'";:?.,]?a[-_`~!^&*()=+'";:?.,]?g[-_`~!^&*()=+'";:?.,]?e}i describe SARE_OBFU_MORTGAGE_POX found apparent obfuscation of word used in spam score SARE_OBFU_MORTGAGE_POX 1.666 #counts SARE_OBFU_MORTGAGE_POX 413s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_MORTGAGE_POX 659s/0h of 274568 corpus (109718s/164850h RM) 05/09/05 #counts SARE_OBFU_MORTGAGE_POX 28s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_MORTGAGE_POX 34s/0h of 47845 corpus (43810s/4035h MY) 05/28/05 #counts SARE_OBFU_MORTGAGE_POX 26s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_MORTGAGE_POX 13s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_MORTGAGE_POX 4s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 header SARE_OBFU_MORTGAGE_SUB Subject =~ /(?!mortgages?)\b(?:m.o.r.t.g.a.g.e|(?:m|(?:rn|\/V\\|\/\\\/\\|\xCE\x9C|\xD0\x9C|\xD0\xBC))[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[g69]|\xC4[\x9C-\xA3]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[g69]|\xC4[\x9C-\xA3]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3]\b|(?:[\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)))s?\b/i describe SARE_OBFU_MORTGAGE_SUB subject has obfuscated spammer topic score SARE_OBFU_MORTGAGE_SUB 3.333 #stype SARE_OBFU_MORTGAGE_SUB obfu #counts SARE_OBFU_MORTGAGE_SUB 87s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_MORTGAGE_SUB 367s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_OBFU_MORTGAGE_SUB 20s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_OBFU_MORTGAGE_SUB 9s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_MORTGAGE_SUB 37s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_MORTGAGE_SUB 35s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_MORTGAGE_SUB 38s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_MORTGAGE_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_ONLINE_SUB Subject =~ /(?!\bON[- ]?LINE\b)\b(?:o.?n.?l.?i.?n.?e|(?:[o0]|(?:[\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95))[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[l1I\|\xA3]|(?:\xC5[\x80-\x82]|\xC4[\xB9-\xBF]))[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3]\b|(?:[\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)))\b/i describe SARE_OBFU_ONLINE_SUB subject has obfuscated spammer topic score SARE_OBFU_ONLINE_SUB 3.333 #stype SARE_OBFU_ONLINE_SUB obfu #hist SARE_OBFU_ONLINE_SUB Added exclusions; eliminated ham hits #counts SARE_OBFU_ONLINE_SUB 119s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_ONLINE_SUB 345s/0h of 115435 corpus (94246s/21189h) 04/25/04 #counts SARE_OBFU_ONLINE_SUB 34s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_OBFU_ONLINE_SUB 59s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_OBFU_ONLINE_SUB 10s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_ONLINE_SUB 65s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_ONLINE_SUB 10s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_ONLINE_SUB 52s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_ONLINE_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_ONLY_TAG m{>L[-_`~!^&*()=+'";:?.,]?Y\ \$[1-9]}i describe SARE_OBFU_ONLY_TAG found apparent obfuscation of word used in spam score SARE_OBFU_ONLY_TAG 1.666 #counts SARE_OBFU_ONLY_TAG 95s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_ONLY_TAG 991s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_ONLY_TAG 0s/0h of 10829 corpus (6367s/4462h CT) 05/08/05 #counts SARE_OBFU_ONLY_TAG 0s/0h of 46903 corpus (42982s/3921h MY) 05/09/05 #counts SARE_OBFU_ONLY_TAG 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_ORIGSOFT_SUB Subject =~ /(?!original software)(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)?[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)?[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[g69]|\xC4[\x9C-\xA3]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)?[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)?[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[l1I\|\xA3]|(?:\xC5[\x80-\x82]|\xC4[\xB9-\xBF])) (?:[s5\$\xA7]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)?[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:f|\xC5\xBF|\xC6\x92|\xD2[\x92-\x93]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:w|\\\/\\\/|VV|\xC5[\xB4-\xB5]|\xCF[\x88-\x89]|\xCF\x8E])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)?[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)?/i describe SARE_OBFU_ORIGSOFT_SUB found apparent obfuscation of word used in spam score SARE_OBFU_ORIGSOFT_SUB 2.500 #stype SARE_OBFU_ORIGSOFT_SUB obfu #hist SARE_OBFU_ORIGSOFT_SUB Created by Bob Menschel Jul 31 2004 #counts SARE_OBFU_ORIGSOFT_SUB 0s/0h of 196667 corpus (96194s/100473h RM) 02/21/05 #max SARE_OBFU_ORIGSOFT_SUB 92s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_OBFU_ORIGSOFT_SUB 20s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_OBFU_ORIGSOFT_SUB 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_OBFU_ORIGSOFT_SUB 9s/0h of 17008 corpus (14576s/2432h MY) 08/04/04 #counts SARE_OBFU_ORIGSOFT_SUB 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_ORIGSOFT_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_PENIS_SUB Subject =~ /(?!penis)(?!pencils)(?!pennies)(?!Penn is)(?!Prentiss)\b(?:p.?e.?n.?i.?s|p[\W_]?[e3\*\xC8-\xCB\xE8-\xEB][\W_]?[n\xD1\xF1][\W_]?[il1:\|\*\xCC-\xCF\xEC-\xEF][\W_]?[s5\$\xA7])\b/i describe SARE_OBFU_PENIS_SUB subject has obfuscated spammer topic score SARE_OBFU_PENIS_SUB 3.333 #stype SARE_OBFU_PENIS_SUB obfu #hist SARE_OBFU_PENIS_SUB Added exclusion for "pennies" Jan 23 2004 #hist SARE_OBFU_PENIS_SUB Added other exclusions, May 2005 #counts SARE_OBFU_PENIS_SUB 108s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PENIS_SUB 541s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_OBFU_PENIS_SUB 64s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_OBFU_PENIS_SUB 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_OBFU_PENIS_SUB 41s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_PENIS_SUB 9s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PENIS_SUB 14s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_PENIS_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_PHARMACEUT m'(?!pharmaceutical)p+h+(?:[a\@4åä]|/\\)+r+(?:m|rn)+(?:[a\@4åä]|/\\)+c+[e3]+u+t+[i1l\|]+c+(?:[a\@4åä]|/\\)+[l\|]+'i describe SARE_OBFU_PHARMACEUT found apparent obfuscation of word used in spam score SARE_OBFU_PHARMACEUT 1.666 #counts SARE_OBFU_PHARMACEUT 115s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PHARMACEUT 371s/0h of 295111 corpus (124249s/170862h RM) 04/19/05 #counts SARE_OBFU_PHARMACEUT 24s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_PHARMACEUT 8s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_PHARMACEUT 1s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_PHARMACEUT 9s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_PHARM_ONL m{[o0][-_`~!^&*()=+'";:?.,]?[nñ][-_`~!^&*()=+'";:?.,]?[l\|][-_`~!^&*()=+'";:?.,]?[i1l\|][-_`~!^&*()=+'";:?.,]?[nñ][-_`~!^&*()=+'";:?.,]?[e3][-_`~!^&*()=+'";:?.,]?r[-_`~!^&*()=+'";:?.,]?x}i describe SARE_OBFU_PHARM_ONL found apparent obfuscation of word used in spam score SARE_OBFU_PHARM_ONL 2.222 #hist SARE_OBFU_PHARM_ONL Bob Menschel, Apr 23 2005 #counts SARE_OBFU_PHARM_ONL 435s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PHARM_ONL 1560s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_PHARM_ONL 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PHARM_ONL 6s/0h of 10829 corpus (6367s/4462h CT) 05/08/05 #counts SARE_OBFU_PHARM_ONL 217s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_PHARM_ONL 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header __SARE_OK_PHARM Subject =~ /pharmacy/i header __SARE_OBFU_PHARM_SUB Subject =~ /p[p.]?h[h.]?a[a.]?r[ar.]?m[m.]?a[ac.]?c[c.]?[y.]?y/i meta SARE_OBFU_PHARM_SUB ( __SARE_OBFU_PHARM_SUB && !__SARE_OK_PHARM ) describe SARE_OBFU_PHARM_SUB Pharmacy for zombies score SARE_OBFU_PHARM_SUB 2.222 #hist SARE_OBFU_PHARM_SUB Robert Brooks, Mar 23 2005 #counts SARE_OBFU_PHARM_SUB 51s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PHARM_SUB 1177s/0h of 400644 corpus (178197s/222447h RM) 04/02/05 #counts SARE_OBFU_PHARM_SUB 20s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_PHARM_SUB 53s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_OBFU_PHARM_SUB 5s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PHARM_SUB 6s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_OBFU_PHARM_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_PILL_NUM m'(?!pills?)\bp\d?i\d?l\d?l(?:\d?s)?\b'i describe SARE_OBFU_PILL_NUM found apparent obfuscation of word used in spam score SARE_OBFU_PILL_NUM 1.666 #counts SARE_OBFU_PILL_NUM 147s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PILL_NUM 335s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_PILL_NUM 75s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_PILL_NUM 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_PILL_NUM 0s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_PILL_NUM 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_PRESENTLY m'(?!present(?:ly)?)\bp+r+[e3]+s+[e3]+[nñ]+t+(?:[l\|]+y+)?\b'i describe SARE_OBFU_PRESENTLY found apparent obfuscation of word used in spam score SARE_OBFU_PRESENTLY 0.555 #stype SARE_OBFU_PRESENTLY spamp #counts SARE_OBFU_PRESENTLY 21s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PRESENTLY 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_PRESENTLY 0s/0h of 41487 corpus (37599s/3888h MY) 04/18/05 #counts SARE_OBFU_PRESENTLY 0s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_PRESENTLY 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_PROFILE m'(?!PROFILE?(?:s+|[i1l\|]+[nñ]+[g69]+|[e3]+d+)?)\bp+r+[o0]+f+[i1l\|]+[l\|]+e*(?:s+|[i1l\|]+[nñ]+[g69]+|[e3]+d+)?\b'i describe SARE_OBFU_PROFILE found apparent obfuscation of word used in spam score SARE_OBFU_PROFILE 1.666 #counts SARE_OBFU_PROFILE 84s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PROFILE 451s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_PROFILE 92s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_PROFILE 13s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_PROFILE 16s/0h of 47845 corpus (43810s/4035h MY) 05/28/05 #counts SARE_OBFU_PROFILE 12s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PROFILE 16s/0h of 10829 corpus (6367s/4462h CT) 05/08/05 #counts SARE_OBFU_PROFILE 20s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_PUBLISHER m'(?!PUBLISHERs?)\bp+u+b+[l\|]+[i1l\|]+s+h+[e3]+r+s*\b'i describe SARE_OBFU_PUBLISHER found apparent obfuscation of word used in spam score SARE_OBFU_PUBLISHER 1.666 #counts SARE_OBFU_PUBLISHER 80s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PUBLISHER 459s/0h of 293625 corpus (119414s/174211h RM) 04/14/05 #counts SARE_OBFU_PUBLISHER 262s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_PUBLISHER 0s/0h of 41487 corpus (37599s/3888h MY) 04/18/05 #counts SARE_OBFU_PUBLISHER 6s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PUBLISHER 99s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_PUBLISHER 4s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_SAVE_NUM m'(?!save)\bs\d?a\d?v\d?e\b'i describe SARE_OBFU_SAVE_NUM found apparent obfuscation of word used in spam score SARE_OBFU_SAVE_NUM 1.666 #counts SARE_OBFU_SAVE_NUM 287s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_SAVE_NUM 800s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_SAVE_NUM 2s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_SAVE_NUM 129s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_SAVE_NUM 0s/0h of 10828 corpus (6369s/4459h CT) 05/02/05 #counts SARE_OBFU_SAVE_NUM 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_SAVINGS_NUM m'(?!savings)\bs\d?a\d?v\d?i\d?n\d?g\d?s\b'i describe SARE_OBFU_SAVINGS_NUM found apparent obfuscation of word used in spam score SARE_OBFU_SAVINGS_NUM 1.666 #counts SARE_OBFU_SAVINGS_NUM 140s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_SAVINGS_NUM 316s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_SAVINGS_NUM 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_SAVINGS_NUM 59s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_SAVINGS_NUM 0s/0h of 10828 corpus (6369s/4459h CT) 05/02/05 #counts SARE_OBFU_SAVINGS_NUM 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_SPECIAL_TAG m{>(?:S[-_`~!^&*()=+'";:?.,]?P[-_`~!^&*()=+'";:?.,]?E[-_`~!^&*()=+'";:?.,]?C?I?|C?I[-_`~!^&*()=+'";:?.,]?A[-_`~!^&*()=+'";:?.,]?L|\ spe)<}i describe SARE_OBFU_SPECIAL_TAG found apparent obfuscation of word used in spam score SARE_OBFU_SPECIAL_TAG 1.666 #counts SARE_OBFU_SPECIAL_TAG 104s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_SPECIAL_TAG 991s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_SPECIAL_TAG 0s/0h of 10829 corpus (6367s/4462h CT) 05/08/05 #counts SARE_OBFU_SPECIAL_TAG 0s/0h of 46903 corpus (42982s/3921h MY) 05/09/05 #counts SARE_OBFU_SPECIAL_TAG 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_UP_NUM m'(?! UP ) U\d?P 'i describe SARE_OBFU_UP_NUM found apparent obfuscation of word used in spam score SARE_OBFU_UP_NUM 1.666 #counts SARE_OBFU_UP_NUM 140s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_UP_NUM 351s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_UP_NUM 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_UP_NUM 59s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_UP_NUM 0s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_UP_NUM 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 #body SARE_OBFU_VICODIN /(?!\bVICODIN\b)(?:\b([vu])(?:\1){0,2}|\B(\\\/|\xCE\xBD)(?:\2){0,2})[\W\d_]?([il1:\|\*ý-ýý-ýý]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)(?:\3){0,2}[\W\d_]?([c\*ýýýý]|\xC4[\x86-\x8D]|\xD0\xA1|\xD1\x81)(?:\4){0,2}[\W\d_]?([o0\*ýýýýý-ýý-ý]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)(?:\5){0,2}[\W\d_]?([dý]|\xC4[\x8E-\x91])(?:\6){0,2}[\W\d_]?([il1:\|\*ý-ýý-ýý]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)(?:\7){0,2}[\W\d_]?(?:(n)(?:\8){0,2}\b|([ýý]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)(?:\9){0,2}\B)/i #describe SARE_OBFU_VICODIN found apparent obfuscation of word used in spam #score SARE_OBFU_VICODIN 2.222 #counts SARE_OBFU_VICODIN 25s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_VICODIN 1368s/0h of 290849 corpus (122033s/168816h RM) 05/01/05 #counts SARE_OBFU_VICODIN 260s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_VICODIN 44s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_VICODIN 106s/0h of 46903 corpus (42982s/3921h MY) 05/09/05 #counts SARE_OBFU_VICODIN 58s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_VICODIN 264s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_VICODIN 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_VOLUME m'(?!VOLUMEs?)\b(?:[vw]|\\/)+[o0]+[l\|]+u+(?:m|rn)+[e3]+s*\b'i describe SARE_OBFU_VOLUME found apparent obfuscation of word used in spam score SARE_OBFU_VOLUME 1.666 #counts SARE_OBFU_VOLUME 564s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_VOLUME 80s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_VOLUME 3s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_VOLUME 13s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_VOLUME 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_WILL m'(?!WILL(?:s?|ing|ed)?)\bwi[l\|]{2,}(?:s+|[i1l\|]+[nñ]+[g69]+|[e3]+d+)?\b'i describe SARE_OBFU_WILL found apparent obfuscation of word used in spam score SARE_OBFU_WILL 2.222 #counts SARE_OBFU_WILL 87s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_WILL 627s/0h of 274568 corpus (109718s/164850h RM) 05/09/05 #counts SARE_OBFU_WILL 280s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_WILL 3s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_WILL 18s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_WILL 112s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_WILL 20s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_WRONGFULLY m'(?!wrongful(?:ly)?)\bw+r+[o0]+[nñ]+[g69]+f+u+[l\|]+(?:[l\|]+y+)?\b'i describe SARE_OBFU_WRONGFULLY found apparent obfuscation of word used in spam score SARE_OBFU_WRONGFULLY 1.666 #counts SARE_OBFU_WRONGFULLY 52s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_WRONGFULLY 499s/0h of 274568 corpus (109718s/164850h RM) 05/09/05 #counts SARE_OBFU_WRONGFULLY 175s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_WRONGFULLY 0s/0h of 41487 corpus (37599s/3888h MY) 04/18/05 #counts SARE_OBFU_WRONGFULLY 8s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_WRONGFULLY 66s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_WRONGFULLY 13s/0h of 2202 corpus (356s/1846h ft) 05/16/05 #body SARE_OBFU_XANAX /(?!\bXANAX\b)(?:\b(x)(?:\1){0,2}|\B([ý]|\>\<|\}\{|\xCE\xA7|\xCF\x87|\xD0\xA5|\xD1\x85|\xD2[\xB2-\xB3])(?:\2){0,2})[\W\d_]?([a4\*\@ý-ýýý-ý]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)(?:\3){0,2}[\W\d_]?([nýý]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)(?:\4){0,2}[\W\d_]?([a4\*\@ý-ýýý-ý]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)(?:\5){0,2}[\W\d_]?(?:(x)(?:\6){0,2}\b|([ý]|\>\<|\}\{|\xCE\xA7|\xCF\x87|\xD0\xA5|\xD1\x85|\xD2[\xB2-\xB3])(?:\7){0,2}\B)/i #describe SARE_OBFU_XANAX found apparent obfuscation of word used in spam #score SARE_OBFU_XANAX 2.222 #hist SARE_OBFU_XANAX Bob Menschel, April 2005 #overlap SARE_OBFU_XANAX Replaces MANGLED_XANAX by Jennifer Wheeler (hits 9% more spam) #counts SARE_OBFU_XANAX 208s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_XANAX 1529s/0h of 290849 corpus (122033s/168816h RM) 05/01/05 #counts SARE_OBFU_XANAX 141s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_XANAX 73s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_XANAX 80s/0h of 43978 corpus (40095s/3883h MY) 05/01/05 #counts SARE_OBFU_XANAX 83s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_XANAX 170s/0h of 10829 corpus (6367s/4462h CT) 05/08/05 #counts SARE_OBFU_XANAX 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_NUM_YOUR m'(?!YOUR)\bY\d?O\d?U\d?R\b'i describe SARE_OBFU_NUM_YOUR found apparent obfuscation of word used in spam score SARE_OBFU_NUM_YOUR 1.666 #counts SARE_OBFU_NUM_YOUR 140s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_NUM_YOUR 343s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_NUM_YOUR 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_NUM_YOUR 59s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_NUM_YOUR 0s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_NUM_YOUR 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 # EOF # SARE Obfuscation Ruleset for SpamAssassin - file 1 # Version: 01.00.08 # Created: 2005-05-02 # Modified: 2005-10-01 # Usage instructions and documentation in 70_sare_obfu0.cf # Full Revision History / Change Log in 70_sare_obfu.log #@@# 01.00.08: Oct 01 2005 #@@# Minor score updates based on additional mass-check #@@# Added file 1: SARE_OBFU_ONLINE #@@# Added file 1: SARE_OBFU_PHARM #@@# Added file 1: SARE_OBFU_PHARM_POX #@@# Added file 1: SARE_OBFU_SPLIT_REDIR #@@# Added file 1: SARE_OBFU_SUB_DOUBLEV #@@# Archived from file 1: SARE_OBFU_OBLIGATION #@@# Moved file 0 to file 1: SARE_OBFU_ALWAYS #@@# Moved file 0 to file 1: SARE_OBFU_CIALIS #@@# Moved file 0 to file 1: SARE_OBFU_CREDIT_POX #@@# Moved file 0 to file 1: SARE_OBFU_GOALS #@@# Moved file 0 to file 1: SARE_OBFU_ORDERING_SPL #@@# Moved file 0 to file 1: SARE_OBFU_RELIABLE #@@# Moved file 0 to file 1: SARE_OBFU_RESULTING #@@# Moved file 0 to file 1: SARE_OBFU_SOMA #@@# Moved file 0 to file 1: SARE_OBFU_STOCKS #@@# Moved file 1 genlsubj to file 1 obfu: SARE_SUB_AGING_OB renamed to SARE_OBFU_AGING_SUB #@@# Moved file 1 genlsubj to file 1 obfu: SARE_SUB_FOR_OB renamed to SARE_OBFU_FOR_SUB #@@# Moved file 1 to file 2: SARE_OBFU_BETTER_SUB #@@# Moved file 1 to file 2: SARE_OBFU_CARTRDGE_SUB #@@# Moved file 1 to file 3: SARE_OBFU_SEX_SPL #@@# Moved file 1 to file 3: SARE_OBFU_TBL_05 #@@# Moved file 1 to file 4: SARE_OBFU_AMP #@@# Moved file 2 to file 1: SARE_OBFU_REFINANC_NUM # License: Artistic - see http://www.rulesemporium.com/license.txt # Current Maintainer: Bob Menschel - RMSA@Menschel.net # Current Home: http://www.rulesemporium.com/rules/70_sare_obfu1.cf ######## ###################### ################################################## # Rules renamed or moved ######## ###################### ################################################## meta SARE_OBFU_OBLIGATION 0 meta SARE_SUB_AGING_OB 0 meta SARE_SUB_FOR_OB 0 meta SARE_OBFU_BETTER_SUB 0 meta SARE_OBFU_CARTRDGE_SUB 0 meta SARE_OBFU_SEX_SPL 0 meta SARE_OBFU_TBL_05 0 meta SARE_OBFU_AMP 0 ######## ###################### ################################################## # Technical Obfuscations ######## ###################### ################################################## header SARE_OBFU_SUB_DOUBLEV Subject =~ /(?!^\[\w+\])(?:^|.)(?:\bvv\w\w+|\w\w+vv\b)(?:$|.)/i describe SARE_OBFU_SUB_DOUBLEV Subject has word with double "v" at start or end score SARE_OBFU_SUB_DOUBLEV 0.686 #ham SARE_OBFU_SUB_DOUBLEV confirmed: Several #hist SARE_OBFU_SUB_DOUBLEV Maurice Makaay and Bob Menschel, June 2005 #counts SARE_OBFU_SUB_DOUBLEV 113s/11h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_SUB_DOUBLEV 125s/0h of 314221 corpus (149090s/165131h RM) 06/21/05 #counts SARE_OBFU_SUB_DOUBLEV 163s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_SUB_DOUBLEV 2s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_SUB_DOUBLEV 3s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 rawbody __SARE_OBFU_SPLIT_HR2A /href\s{0,5}=\s{0,5}"[^"]{0,15}[\r\n]/is full __SARE_OBFU_SPLIT_HR2B /href\s{0,5}=\s{0,5}"[^"]{0,15}[\r\n]/is meta SARE_OBFU_SPLIT_HR2 __SARE_OBFU_SPLIT_HR2A || __SARE_OBFU_SPLIT_HR2B score SARE_OBFU_SPLIT_HR2 0.183 describe SARE_OBFU_SPLIT_HR2 unescaped cr in uri #counts SARE_OBFU_SPLIT_HR2 2410s/942h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_SPLIT_HR2 5168s/50h of 299858 corpus (141237s/158621h RM) 07/12/05 #counts SARE_OBFU_SPLIT_HR2 2s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_SPLIT_HR2 10s/3h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_OBFU_SPLIT_HR2 751s/15h of 57287 corpus (52272s/5015h MY) 09/22/05 full SARE_OBFU_SPLIT_REDIR m'/(?:(?!httt?ps?://)h.?t.?t.?p.?:.?/.?/)'i describe SARE_OBFU_SPLIT_REDIR gappy redirect score SARE_OBFU_SPLIT_REDIR 1.666 #stype SARE_OBFU_SPLIT_REDIR obfu #ham SARE_OBFU_SPLIT_REDIR misspelled (2) #hist SARE_OBFU_SPLIT_REDIR Bob Menschel, June 16 2005 #counts SARE_OBFU_SPLIT_REDIR 0s/2h of 619677 corpus (318875s/300802h RM) 09/11/05 #max SARE_OBFU_SPLIT_REDIR 3s/0h of 267372 corpus (127006s/140366h RM) 06/19/05 #counts SARE_OBFU_SPLIT_REDIR 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_SPLIT_REDIR 1s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #full SARE_OBFU_TBL_02 /]{2,35}>[a-z]{1,2}<\/TD>\s+<\/td>\s+]{2,35}>[a-z]{1,2}<\/TD>/is #describe SARE_OBFU_TBL_02 Apparent attempt at obfuscation using tables #score SARE_OBFU_TBL_02 1.117 #hist SARE_OBFU_TBL_02 Fred Tarasevicius, May 2005 #counts SARE_OBFU_TBL_02 5s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_TBL_02 83s/0h of 260791 corpus (115716s/145075h RM) 05/25/05 #counts SARE_OBFU_TBL_02 3s/0h of 2577 corpus (569s/2008h ft) 05/17/05 #counts SARE_OBFU_TBL_02 0s/0h of 10791 corpus (6349s/4442h CT) 05/17/05 #counts SARE_OBFU_TBL_02 9s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_TBL_02 10s/0h of 47845 corpus (43810s/4035h MY) 05/28/05 #full SARE_OBFU_TBL_03 /[a-z]<\/td>\s+[a-z]<\/td>\s+[a-z]<\/td>/is #describe SARE_OBFU_TBL_03 Apparent attempt at obfuscation using tables #score SARE_OBFU_TBL_03 0.667 #hist SARE_OBFU_TBL_03 Fred Tarasevicius, May 2005 #counts SARE_OBFU_TBL_03 13s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_TBL_03 15s/0h of 260791 corpus (115716s/145075h RM) 05/25/05 #counts SARE_OBFU_TBL_03 3s/0h of 2577 corpus (569s/2008h ft) 05/17/05 #counts SARE_OBFU_TBL_03 0s/0h of 10791 corpus (6349s/4442h CT) 05/17/05 #counts SARE_OBFU_TBL_03 2s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #rawbody __SARE_OBFU_TBL0 /'"]|"[^"]*"|'[^']*')*>(?:<(?!\/?td)(?:[^>'"]|"[^"]*"|'[^']*')*>){0,6}<\/td(?:[^>'"]|"[^"]*"|'[^']*')*>/i #rawbody __SARE_OBFU_TBL1 /'"]|"[^"]*"|'[^']*')*>(?:<(?!\/?td)(?:[^>'"]|"[^"]*"|'[^']*')*>){0,5}(?!a)(?:[a-z]|&[a-z];)(?:<(?!\/?td)(?:[^>'"]|"[^"]*"|'[^']*')*>){0,5}<\/td(?:[^>'"]|"[^"]*"|'[^']*')*>/i #rawbody __SARE_OBFU_TBL2 /'"]|"[^"]*"|'[^']*')*>(?:<(?!\/?td)(?:[^>'"]|"[^"]*"|'[^']*')*>){0,5}(?![oi][ns]|an?|en|of|de|l[ae]|us|no|tm|ok)(?:[a-z]|&[a-z];){2}(?:<(?!\/?td)(?:[^>'"]|"[^"]*"|'[^']*')*>){0,5}<\/td(?:[^>'"]|"[^"]*"|'[^']*')*>/i #rawbody __SARE_OBFU_TBL3 /'"]|"[^"]*"|'[^']*')*>(?:<(?!\/?td)(?:[^>'"]|"[^"]*"|'[^']*')*>){0,5}(?:[a-z]|&[a-z];){3}(?:<(?!\/?td)(?:[^>'"]|"[^"]*"|'[^']*')*>){0,5}<\/td(?:[^>'"]|"[^"]*"|'[^']*')*>/i #meta SARE_OBFU_TBL_06 __SARE_OBFU_TBL0 + __SARE_OBFU_TBL1 + __SARE_OBFU_TBL2 + __SARE_OBFU_TBL3 > 2 #score SARE_OBFU_TBL_06 1.065 #hist SARE_OBFU_TBL_06 Doc Schneider, May 2005 #counts SARE_OBFU_TBL_06 5117s/56h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_TBL_06 5400s/21h of 256493 corpus (108871s/147622h RM) 05/18/05 #counts SARE_OBFU_TBL_06 17s/2h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_TBL_06 6s/0h of 4677 corpus (810s/3867h ft) 05/28/05 #counts SARE_OBFU_TBL_06 639s/4h of 57287 corpus (52272s/5015h MY) 09/22/05 #meta SARE_OBFU_TBL_07 __SARE_OBFU_TBL0 + __SARE_OBFU_TBL1 + __SARE_OBFU_TBL2 + __SARE_OBFU_TBL3 > 3 #score SARE_OBFU_TBL_07 1.666 #hist SARE_OBFU_TBL_07 Doc Schneider, May 2005 #counts SARE_OBFU_TBL_07 1334s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_TBL_07 4407s/17h of 256493 corpus (108871s/147622h RM) 05/18/05 #counts SARE_OBFU_TBL_07 13s/0h of 10789 corpus (6346s/4443h CT) 05/17/05 #counts SARE_OBFU_TBL_07 4s/0h of 4677 corpus (810s/3867h ft) 05/28/05 #counts SARE_OBFU_TBL_07 438s/1h of 57287 corpus (52272s/5015h MY) 09/22/05 ######## ###################### ################################################## # Numerical Obfuscations ######## ###################### ################################################## body SARE_OBFU_NUMBERS /\$\d\d?O\s*[MBT]/i describe SARE_OBFU_NUMBERS Obfuscation involving numbers score SARE_OBFU_NUMBERS 0.631 #hist SARE_OBFU_NUMBERS Fred Tarasevicius, May 2005 #counts SARE_OBFU_NUMBERS 7s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_NUMBERS 74s/2h of 258068 corpus (113628s/144440h RM) 05/27/05 #counts SARE_OBFU_NUMBERS 9s/0h of 47668 corpus (43699s/3969h MY) 05/27/05 #counts SARE_OBFU_NUMBERS 2s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_NUMBERS 6s/0h of 10790 corpus (6348s/4442h CT) 05/27/05 #counts SARE_OBFU_NUMBERS 9s/0h of 4650 corpus (807s/3843h ft) 05/27/05 ######## ###################### ################################################## # Partial Word Obfuscations ######## ###################### ################################################## body SARE_OBFU_PART_ALI /[\s"'-][a-z01]{0,10}a[1|]i[a-z01]{0,10}[,.?!]*[\s"'-]/i describe SARE_OBFU_PART_ALI obfusciation of word containing ali score SARE_OBFU_PART_ALI 1.666 #counts SARE_OBFU_PART_ALI 213s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PART_ALI 718s/0h of 272320 corpus (132055s/140265h RM) 06/04/05 #counts SARE_OBFU_PART_ALI 38s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PART_ALI 108s/0h of 10810 corpus (6362s/4448h CT) 06/03/05 #counts SARE_OBFU_PART_ALI 13s/0h of 4661 corpus (810s/3851h ft) 05/29/05 #counts SARE_OBFU_PART_ALI 69s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_PART_ALI 78s/0h of 47708 corpus (43712s/3996h MY) 05/30/05 body SARE_OBFU_PART_CIA /(?![\s"'-][0-9a-fx]*[,.?!]*[\s"'-])[\s"'-][a-z01]{0,10}c1a[a-z01]{0,10}[,.?!]*[\s"'-]/i describe SARE_OBFU_PART_CIA obfusciation of word containing cia score SARE_OBFU_PART_CIA 1.666 #hist SARE_OBFU_PART_CIA Robert Brooks, May 2005 #ham SARE_OBFU_PART_CIA confirmed (3) #counts SARE_OBFU_PART_CIA 2540s/7h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PART_CIA 89s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_PART_CIA 1s/0h of 4661 corpus (810s/3851h ft) 05/29/05 #counts SARE_OBFU_PART_CIA 83s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_PART_CIA 88s/0h of 47708 corpus (43712s/3996h MY) 05/30/05 body SARE_OBFU_PART_IAL /[\s"'-][a-z01]{1,10}1al[a-z01]{0,10}[,.?!]*[\s"'-]/i describe SARE_OBFU_PART_IAL obfusciation of word containing ial score SARE_OBFU_PART_IAL 1.666 #ham SARE_OBFU_PART_IAL confirmed #hist SARE_OBFU_PART_IAL Robert Brooks, May 2005 #counts SARE_OBFU_PART_IAL 2502s/5h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PART_IAL 89s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_PART_IAL 1s/0h of 4661 corpus (810s/3851h ft) 05/29/05 #counts SARE_OBFU_PART_IAL 25s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_PART_IAL 26s/0h of 47708 corpus (43712s/3996h MY) 05/30/05 body __SARE_OBFU_PART_ICEa /(?![\s-][0-9a-fx]*[,.?!]*[\s-])[\s-][a-z01]{0,10}[a-z]1ce[a-z01]{0,10}[,.?!]*[\s-]/i body __SARE_OBFU_PART_ICEb /(?![\s"'-][0-9a-fx]*[,.?!]*[\s"'-])[\s"'-][a-z01]{0,10}[a-z]1ce[a-z01]{0,10}[,.?!]*[\s"'-]/i meta SARE_OBFU_PART_ICE __SARE_OBFU_PART_ICEa || __SARE_OBFU_PART_ICEb describe SARE_OBFU_PART_ICE obfusciation of word containing ice score SARE_OBFU_PART_ICE 1.666 #hist SARE_OBFU_PART_ICE Robert Brooks, May 2005 #counts SARE_OBFU_PART_ICE 429s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PART_ICE 14s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PART_ICE 26s/0h of 10813 corpus (6354s/4459h CT) 05/29/05 #counts SARE_OBFU_PART_ICE 0s/0h of 4661 corpus (810s/3851h ft) 05/29/05 #counts SARE_OBFU_PART_ICE 22s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 body __SARE_OBFU_PART_ICRa /[\s-][a-z01]{1,10}1cr[a-z01]{1,10}[,.?!]*[\s-]/i body __SARE_OBFU_PART_ICRb /[\s"'-][a-z01]{1,10}1cr[a-z01]{1,10}[,.?!]*[\s"'-]/i meta SARE_OBFU_PART_ICR __SARE_OBFU_PART_ICRa || __SARE_OBFU_PART_ICRb describe SARE_OBFU_PART_ICR obfusciation of word containing icr score SARE_OBFU_PART_ICR 0.640 #ham SARE_OBFU_PART_ICR confirmed (3) #hist SARE_OBFU_PART_ICR Robert Brooks, May 2005 #counts SARE_OBFU_PART_ICR 68s/4h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PART_ICR 122s/0h of 272187 corpus (131893s/140294h RM) 05/30/05 #counts SARE_OBFU_PART_ICR 6s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PART_ICR 25s/0h of 10810 corpus (6362s/4448h CT) 06/03/05 #counts SARE_OBFU_PART_ICR 0s/0h of 4661 corpus (810s/3851h ft) 05/29/05 #counts SARE_OBFU_PART_ICR 2s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_PART_ICR 15s/0h of 47708 corpus (43712s/3996h MY) 05/30/05 body SARE_OBFU_PART_IES /[\s"'-][a-z01]{0,10}[a-z][1|]es[a-z01]{0,10}[,.?!]*[\s"'-]/i describe SARE_OBFU_PART_IES obfusciation of word containing ies score SARE_OBFU_PART_IES 1.666 #ham SARE_OBFU_PART_IES confirmed (3) #hist SARE_OBFU_PART_IES Robert Brooks, May 2005 #counts SARE_OBFU_PART_IES 740s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PART_IES 13s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PART_IES 86s/0h of 10810 corpus (6362s/4448h CT) 06/03/05 #counts SARE_OBFU_PART_IES 24s/0h of 4661 corpus (810s/3851h ft) 05/29/05 #counts SARE_OBFU_PART_IES 8s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 body SARE_OBFU_PART_INA /[\s"'-][a-z01]{0,10}(?:[bcdfghkmnprstw]l|1)na[bcfghilmnprstuvw][a-z01]{0,10}[,.?!]*[\s"'-]/i describe SARE_OBFU_PART_INA obfusciation of word containing ina score SARE_OBFU_PART_INA 0.786 #ham SARE_OBFU_PART_INA confirmed (4) #hist SARE_OBFU_PART_INA Robert Brooks, June 2005 #counts SARE_OBFU_PART_INA 390s/13h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PART_INA 816s/6h of 297540 corpus (135913s/161627h RM) 06/06/05 #counts SARE_OBFU_PART_INA 129s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_PART_INA 60s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_PART_INA 2s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 body SARE_OBFU_PART_ING /[\s"'-][a-z01]{0,10}(?:[bcdefghjkmnoprstuvwxyz]l|[a-z][1|])ng[a-z01]{0,10}[,.?!]*[\s"']/i describe SARE_OBFU_PART_ING obfusciation of word containing ing score SARE_OBFU_PART_ING 1.666 #ham SARE_OBFU_PART_ING confirmed (4), plus intentional script-kiddie emulation (one word in long technical email) #hist SARE_OBFU_PART_ING Robert Brooks, May 2005 #counts SARE_OBFU_PART_ING 8761s/15h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PART_ING 93s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PART_ING 199s/0h of 10810 corpus (6362s/4448h CT) 06/03/05 #counts SARE_OBFU_PART_ING 1s/0h of 4661 corpus (810s/3851h ft) 05/29/05 #counts SARE_OBFU_PART_ING 287s/1h of 57287 corpus (52272s/5015h MY) 09/22/05 body SARE_OBFU_PART_ION /[\s"'-][a-z013]{0,10}(?!\bl10n\b)[cdghlnprstvxz](?:1[o0]|i0)n[a-z01]{0,10}[,.?!]*[\s"']/i describe SARE_OBFU_PART_ION obfusciation of word containing ion score SARE_OBFU_PART_ION 1.666 #ham SARE_OBFU_PART_ION confirmed (1) #hist SARE_OBFU_PART_ION Robert Brooks, May 2005 #counts SARE_OBFU_PART_ION 4999s/5h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PART_ION 30s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PART_ION 143s/0h of 10810 corpus (6362s/4448h CT) 06/03/05 #counts SARE_OBFU_PART_ION 5s/0h of 4661 corpus (810s/3851h ft) 05/29/05 #counts SARE_OBFU_PART_ION 112s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 body SARE_OBFU_PART_IUM /[\s"'-][a-z01]{1,10}1um[a-z01]{0,10}[,.?!]*[\s"'-]/i describe SARE_OBFU_PART_IUM obfusciation of word containing ium score SARE_OBFU_PART_IUM 0.978 #hist SARE_OBFU_PART_IUM Robert Brooks, May 2005 #counts SARE_OBFU_PART_IUM 3s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PART_IUM 131s/1h of 272187 corpus (131893s/140294h RM) 05/30/05 #counts SARE_OBFU_PART_IUM 4s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PART_IUM 6s/0h of 10813 corpus (6354s/4459h CT) 05/29/05 #counts SARE_OBFU_PART_IUM 0s/0h of 4661 corpus (810s/3851h ft) 05/29/05 #counts SARE_OBFU_PART_IUM 11s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_PART_IUM 14s/0h of 47708 corpus (43712s/3996h MY) 05/30/05 body __SARE_OBFU_PART_IVEa /[\s-][a-z01]{1,10}[1|]ve[a-z01]{0,10}[,.?!]*[\s-]/i body __SARE_OBFU_PART_IVEb /[\s"'-][a-z01]{1,10}[1|]ve[a-z01]{0,10}[,.?!]*[\s"'-]/i meta SARE_OBFU_PART_IVE __SARE_OBFU_PART_IVEa || __SARE_OBFU_PART_IVEb describe SARE_OBFU_PART_IVE obfusciation of word containing ive score SARE_OBFU_PART_IVE 0.985 #hist SARE_OBFU_PART_IVE Robert Brooks, May 2005 #counts SARE_OBFU_PART_IVE 196s/2h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PART_IVE 326s/1h of 272187 corpus (131893s/140294h RM) 05/30/05 #counts SARE_OBFU_PART_IVE 16s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PART_IVE 105s/0h of 10810 corpus (6362s/4448h CT) 06/03/05 #counts SARE_OBFU_PART_IVE 4s/0h of 4661 corpus (810s/3851h ft) 05/29/05 #counts SARE_OBFU_PART_IVE 16s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 body SARE_OBFU_PART_OCK /[\s"'-][a-z01]{1,10}0ck[a-z01]{0,10}[,.?!]*[\s"'-]/i describe SARE_OBFU_PART_OCK obfusciation of word containing ock score SARE_OBFU_PART_OCK 1.666 #hist SARE_OBFU_PART_OCK Robert Brooks, May 2005 #counts SARE_OBFU_PART_OCK 20645s/6h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PART_OCK 25s/0h of 4661 corpus (810s/3851h ft) 05/29/05 #counts SARE_OBFU_PART_OCK 54s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PART_OCK 119s/0h of 10810 corpus (6362s/4448h CT) 06/03/05 #counts SARE_OBFU_PART_OCK 302s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 body SARE_OBFU_PART_OFF /(?![\s"'-][0-9a-fx]*[,.?!]*[\s"'-])[\s"'-][a-z01]{0,10}0ff[a-z01]{0,10}[,.?!]*[\s"'-]/i describe SARE_OBFU_PART_OFF obfusciation of word containing off score SARE_OBFU_PART_OFF 1.574 #hist SARE_OBFU_PART_OFF Robert Brooks, May 2005 #counts SARE_OBFU_PART_OFF 1875s/11h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PART_OFF 36s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PART_OFF 268s/0h of 10810 corpus (6362s/4448h CT) 06/03/05 #counts SARE_OBFU_PART_OFF 11s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_OBFU_PART_OFF 277s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 body SARE_OBFU_PART_OFT /[\s"'-][a-z01]{0,10}[lors]0ft[a-z01]{0,10}[,.?!]*[\s"'-]/i describe SARE_OBFU_PART_OFT obfusciation of word containing oft score SARE_OBFU_PART_OFT 2.333 #hist SARE_OBFU_PART_OFT Robert Brooks, May 2005 #counts SARE_OBFU_PART_OFT 2653s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PART_OFT 99s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PART_OFT 116s/0h of 10810 corpus (6362s/4448h CT) 06/03/05 #counts SARE_OBFU_PART_OFT 0s/0h of 4661 corpus (810s/3851h ft) 05/29/05 #counts SARE_OBFU_PART_OFT 33s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_PART_OFT 60s/0h of 47708 corpus (43712s/3996h MY) 05/30/05 body SARE_OBFU_PART_ONA /[\s"'-][a-z01]{1,10}0na[a-z01]{1,10}[,.?!]*[\s"'-]/i describe SARE_OBFU_PART_ONA obfusciation of word containing ona score SARE_OBFU_PART_ONA 0.901 #hist SARE_OBFU_PART_ONA Robert Brooks, May 2005 #counts SARE_OBFU_PART_ONA 222s/3h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PART_ONA 421s/0h of 297540 corpus (135913s/161627h RM) 06/06/05 #counts SARE_OBFU_PART_ONA 17s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PART_ONA 26s/0h of 10813 corpus (6354s/4459h CT) 05/29/05 #counts SARE_OBFU_PART_ONA 3s/0h of 4661 corpus (810s/3851h ft) 05/29/05 #counts SARE_OBFU_PART_ONA 7s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_PART_ONA 19s/0h of 47708 corpus (43712s/3996h MY) 05/30/05 body __SARE_OBFU_PART_ONEa /[\s-][a-z01]{1,10}0ne[a-z01]{1,10}[,.?!]*[\s-]/i body __SARE_OBFU_PART_ONEb /[\s"'-][a-z01]{1,10}0ne[a-z01]{1,10}[,.?!]*[\s"'-]/i meta SARE_OBFU_PART_ONE __SARE_OBFU_PART_ONEa || __SARE_OBFU_PART_ONEb describe SARE_OBFU_PART_ONE obfusciation of word containing one score SARE_OBFU_PART_ONE 1.666 #hist SARE_OBFU_PART_ONE Robert Brooks, May 2005 #counts SARE_OBFU_PART_ONE 4039s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PART_ONE 20s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PART_ONE 36s/0h of 10813 corpus (6354s/4459h CT) 05/29/05 #counts SARE_OBFU_PART_ONE 1s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_OBFU_PART_ONE 11s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 body SARE_OBFU_PART_ONS /[\s"'-][a-z01]{0,10}[a-z]0ns[a-z01]{0,10}[,.?!]*[\s"'-]/i describe SARE_OBFU_PART_ONS obfusciation of word containing ons score SARE_OBFU_PART_ONS 1.666 #hist SARE_OBFU_PART_ONS Robert Brooks, May 2005 #counts SARE_OBFU_PART_ONS 1506s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PART_ONS 11s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PART_ONS 24s/0h of 10813 corpus (6354s/4459h CT) 05/29/05 #counts SARE_OBFU_PART_ONS 1s/0h of 4661 corpus (810s/3851h ft) 05/29/05 #counts SARE_OBFU_PART_ONS 111s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 body __SARE_OBFU_PART_ORDa /[\s-][a-z01]{0,10}[a-y]0rd[a-z01]{0,10}[,.?!]*[\s-]/i body __SARE_OBFU_PART_ORDb /[\s"'-][a-z01]{0,10}[a-y]0rd[a-z01]{0,10}[,.?!]*[\s"'-]/i meta SARE_OBFU_PART_ORD __SARE_OBFU_PART_ORDa || __SARE_OBFU_PART_ORDb describe SARE_OBFU_PART_ORD obfusciation of word containing ord score SARE_OBFU_PART_ORD 0.952 #hist SARE_OBFU_PART_ORD Robert Brooks, May 2005 #counts SARE_OBFU_PART_ORD 563s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PART_ORD 7s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_PART_ORD 0s/0h of 4376 corpus (763s/3613h ft) 05/26/05 #counts SARE_OBFU_PART_ORD 3s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_PART_ORD 4s/0h of 47845 corpus (43810s/4035h MY) 05/28/05 body SARE_OBFU_PART_ORE /[\s"'-][a-z016]{0,10}[a-y]0re[a-z01]{0,10}[,.?!]*[\s"'-]/i describe SARE_OBFU_PART_ORE obfusciation of word containing ore score SARE_OBFU_PART_ORE 1.443 #hist SARE_OBFU_PART_ORE Robert Brooks, May 2005 #counts SARE_OBFU_PART_ORE 2900s/18h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PART_ORE 34s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PART_ORE 80s/0h of 10813 corpus (6354s/4459h CT) 05/29/05 #counts SARE_OBFU_PART_ORE 2s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_OBFU_PART_ORE 99s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 body SARE_OBFU_PART_ORG /[\s"'-][a-z01]{0,10}0rg[a-z01]{0,10}[,.?!]*[\s"'-]/i describe SARE_OBFU_PART_ORG obfusciation of word containing org score SARE_OBFU_PART_ORG 1.666 #hist SARE_OBFU_PART_ORG Robert Brooks, May 2005 #counts SARE_OBFU_PART_ORG 685s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PART_ORG 25s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_PART_ORG 0s/0h of 4661 corpus (810s/3851h ft) 05/29/05 #counts SARE_OBFU_PART_ORG 1s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 body __SARE_OBFU_PART_ORTa /[\s-][a-z01]{1,10}0rt[a-z01]{0,10}[,.?!]*[\s]/i body __SARE_OBFU_PART_ORTb /[\s"'-][a-z01]{1,10}0rt[a-z01]{0,10}[,.?!]*[\s"']/i meta SARE_OBFU_PART_ORT __SARE_OBFU_PART_ORTa || __SARE_OBFU_PART_ORTb describe SARE_OBFU_PART_ORT obfusciation of word containing ort score SARE_OBFU_PART_ORT 1.666 #hist SARE_OBFU_PART_ORT Robert Brooks, May 2005 #counts SARE_OBFU_PART_ORT 1878s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PART_ORT 203s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_PART_ORT 9s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_OBFU_PART_ORT 25s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PART_ORT 40s/0h of 10810 corpus (6362s/4448h CT) 06/03/05 body SARE_OBFU_PART_OUS /[\s-][a-z01]{0,10}[a-z]0us[a-z01]{0,10}[,.?!]*[\s-]/i describe SARE_OBFU_PART_OUS obfusciation of word containing ous score SARE_OBFU_PART_OUS 1.666 #hist SARE_OBFU_PART_OUS Robert Brooks, May 2005 #counts SARE_OBFU_PART_OUS 982s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PART_OUS 3s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PART_OUS 4s/0h of 10813 corpus (6354s/4459h CT) 05/29/05 #counts SARE_OBFU_PART_OUS 1s/0h of 4661 corpus (810s/3851h ft) 05/29/05 #counts SARE_OBFU_PART_OUS 6s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 body SARE_OBFU_PART_OVE /[\s-][a-z01]{1,10}0ve[a-z01]{0,10}[,.?!]*[\s]/i describe SARE_OBFU_PART_OVE obfusciation of word containing ove score SARE_OBFU_PART_OVE 1.666 #counts SARE_OBFU_PART_OVE 2497s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PART_OVE 19s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PART_OVE 27s/0h of 10813 corpus (6354s/4459h CT) 05/29/05 #counts SARE_OBFU_PART_OVE 0s/0h of 4661 corpus (810s/3851h ft) 05/29/05 #counts SARE_OBFU_PART_OVE 165s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 ######## ###################### ################################################## # Single Word Obfuscations (alphabetically) ######## ###################### ################################################## body SARE_OBFU_ABLE m'\w{2}(?:(?!ABLE)(?:[a\@4åä]|/\\)B[l\|][e3])\b'i describe SARE_OBFU_ABLE found apparent obfuscation of word used in spam score SARE_OBFU_ABLE 1.666 #ham SARE_OBFU_ABLE verified (1) #hist SARE_OBFU_ABLE Bob Menschel, Apr 23 2005 #counts SARE_OBFU_ABLE 130s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_ABLE 606s/1h of 284851 corpus (112429s/172422h RM) 05/04/05 #counts SARE_OBFU_ABLE 24s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_ABLE 110s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_ABLE 29s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_OBFU_ABLE 4s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 header SARE_OBFU_ACTION_SUB Subject =~ /(?!au?ction)(?!a.c.t.i.o.n)\b(?:a.?c.?t.?i.?o.?n|[a4\*\@\xC0-\xC5\xAA\xE0-\xE5][\W_]?[c\xC7\xE7\xA2\xA9][\W_]?t[\W_]?[il1:\|\*\xCC-\xCF\xEC-\xEF][\W_]?(?:\[\]|\(\)|[o0\*\xD2-\xD6\xF2-\xF6])[\W_]?[n\xD1\xF1])\b/i describe SARE_OBFU_ACTION_SUB subject has obfuscated spammer topic score SARE_OBFU_ACTION_SUB 1.666 #stype SARE_OBFU_ACTION_SUB obfu #counts SARE_OBFU_ACTION_SUB 5s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_ACTION_SUB 7s/0h of 56906 corpus (32313s/24593h RM) 07/25/04 #counts SARE_OBFU_ACTION_SUB 0s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_OBFU_ACTION_SUB 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_OBFU_ACTION_SUB 3s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_ACTION_SUB 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_ACTION_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_SUB_AGING_OB Subject =~ /(?!Age?ing)(?!arguing)(?!A going)\b(?:A.?g.?i.?n.?g|(?:[a4]|(?:[\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0))[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[g6]|\xC4[\x9C-\xA3]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[g6]\b|(?:\xC4[\x9C-\xA3])))\b/i describe SARE_SUB_AGING_OB subject has obfuscated spammer topic score SARE_SUB_AGING_OB 1.666 #stype SARE_SUB_AGING_OB obfu #hist SARE_SUB_AGING_OB Feb 2005: Added exlcusion for misspelling seen only in ham at this time #hist SARE_SUB_AGING_OB Added another exclusion #counts SARE_SUB_AGING_OB 1s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_SUB_AGING_OB 1s/0h of 69717 corpus (42681s/27036h RM) 09/26/04 #counts SARE_SUB_AGING_OB 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_AGING_OB 1s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_AGING_OB 0s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_AGING_OB 0s/0h of 11269 corpus (6578s/4691h CT) 06/11/05 #max SARE_SUB_AGING_OB 1s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 body SARE_OBFU_ALL m'(?!all)\b(?:[a\@4åä]|/\\){1,3}[l\|]{1,3}[l\|]{1,3}\b'i describe SARE_OBFU_ALL found apparent obfuscation of word used in spam score SARE_OBFU_ALL 0.751 #ham SARE_OBFU_ALL verified (several) #counts SARE_OBFU_ALL 702s/23h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_ALL 710s/7h of 284851 corpus (112429s/172422h RM) 05/04/05 #counts SARE_OBFU_ALL 355s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_ALL 1s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_ALL 4s/0h of 41487 corpus (37599s/3888h MY) 04/18/05 #counts SARE_OBFU_ALL 20s/7h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_ALL 121s/8h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_ALL 11s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_ALWAYS m'(?!\@?all?ways)\b(?:[a\@4åä]|/\\)+[l\|]+w+(?:[a\@4åä]|/\\)+y+s+\b'i describe SARE_OBFU_ALWAYS found apparent obfuscation of word used in spam score SARE_OBFU_ALWAYS 1.666 #ham SARE_OBFU_ALWAYS misspelled (1), intentional (1) #counts SARE_OBFU_ALWAYS 41s/2h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_ALWAYS 272s/0h of 284851 corpus (112429s/172422h RM) 05/04/05 #counts SARE_OBFU_ALWAYS 129s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_ALWAYS 1s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_ALWAYS 3s/0h of 41487 corpus (37599s/3888h MY) 04/18/05 #counts SARE_OBFU_ALWAYS 4s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_ALWAYS 54s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_ALWAYS 1s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_BELIEVE m'(?!BELIEVES?)\bB+[e3]{1,3}[l\|]{1,3}[i1l\|]{1,3}[e3]{1,3}(?:[vw]|\\/){1,3}[e3]{1,3}S*\b'i describe SARE_OBFU_BELIEVE found apparent obfuscation of word used in spam score SARE_OBFU_BELIEVE 1.666 #ham SARE_OBFU_BELIEVE verified (several) #hist SARE_OBFU_BELIEVE Bob Menschel, Apr 24 2005 #counts SARE_OBFU_BELIEVE 160s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_BELIEVE 647s/5h of 284851 corpus (112429s/172422h RM) 05/04/05 #counts SARE_OBFU_BELIEVE 23s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_BELIEVE 136s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_BELIEVE 5s/0h of 2202 corpus (356s/1846h ft) 05/16/05 #counts SARE_OBFU_BELIEVE 1s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 header SARE_OBFU_BIGGER_SUB Subject =~ /(?!bigger)(?:b.?i.?g.?g.?e.?r|(?:[b8\xDF]|\xCE\x92|\xCE\xB2|\xD0\x92|\xD0\xB2)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[g69]|\xC4[\x9C-\xA3]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[g69]|\xC4[\x9C-\xA3]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93))/i describe SARE_OBFU_BIGGER_SUB subject has obfuscated spammer topic score SARE_OBFU_BIGGER_SUB 2.500 #stype SARE_OBFU_BIGGER_SUB obfu #counts SARE_OBFU_BIGGER_SUB 16s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_BIGGER_SUB 30s/0h of 91714 corpus (74113s/17601h RM) 01/23/04 #counts SARE_OBFU_BIGGER_SUB 1s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_OBFU_BIGGER_SUB 3s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_BIGGER_SUB 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_OBFU_BIGGER_SUB 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_BIGGER_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_BLANK m'(?!BLANKs?)\bb+[l\|]{1,3}(?:[a\@4åä]|/\\){1,3}[nñ]+k+s*\b'i describe SARE_OBFU_BLANK found apparent obfuscation of word used in spam score SARE_OBFU_BLANK 1.666 #counts SARE_OBFU_BLANK 200s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_BLANK 378s/0h of 274568 corpus (109718s/164850h RM) 05/09/05 #counts SARE_OBFU_BLANK 168s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_BLANK 1s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_BLANK 10s/1h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_BLANK 18s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_BOOST_SUB Subject =~ /(?!boost)\b(?:b.?o.?o.?s.?t|(?:[b8]|\B(?:[\xDF]|\xCE\x92|\xCE\xB2|\xD0\x92|\xD0\xB2))[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[s5\$\xA7]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:t\b|(?:[\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)))\b/i describe SARE_OBFU_BOOST_SUB subject has obfuscated spammer topic score SARE_OBFU_BOOST_SUB 1.666 #stype SARE_OBFU_BOOST_SUB obfu #counts SARE_OBFU_BOOST_SUB 28s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_BOOST_SUB 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_OBFU_BOOST_SUB 2s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_BOOST_SUB 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_OBFU_BOOST_SUB 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_BOOST_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_BREAKTH_SUB Subject =~ /(?!Break[- ]?through)(?:B.?r.?e.?a.?k.?t.?h.?r.?o.?u.?g.?h|(?:[b8\xDF]|\xCE\x92|\xCE\xB2|\xD0\x92|\xD0\xB2)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:k|\xC4[\xB6-\xB8]|\xCE\x9A|\xCE\xBA|\xD0\x8C|\xD0\x9A|\xD0\xBA|\xD1\x9C|\xD2[\x9A-\x9D]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:h|\xC4[\xA4-\xA7]|\xCE\x89|\xCE\x97|\xD0\x9D|\xD0\xBD|\xD1\x92|\xD2[\xA2-\xA3]|\xD2[\xBA-\xBB]|\xD5\xB0])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[uv\*\xB5\xD9-\xDC\xF9-\xFC]|\xC5[\xA8-\xB3]|\xC6[\xAF-\xB0]|\xC7[\x93-\x9C]|\xCE\xB0|\xCE\xBC|\xCF\x8B|\xCF\x8D|\xD4\xB1|\xD5\x84|\xD5\x8D)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[g69]|\xC4[\x9C-\xA3]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:h|\xC4[\xA4-\xA7]|\xCE\x89|\xCE\x97|\xD0\x9D|\xD0\xBD|\xD1\x92|\xD2[\xA2-\xA3]|\xD2[\xBA-\xBB]|\xD5\xB0]))/i describe SARE_OBFU_BREAKTH_SUB subject has obfuscated spammer topic score SARE_OBFU_BREAKTH_SUB 1.666 #stype SARE_OBFU_BREAKTH_SUB obfu #counts SARE_OBFU_BREAKTH_SUB 0s/0h of 299858 corpus (141237s/158621h RM) 07/12/05 #max SARE_OBFU_BREAKTH_SUB 5s/0h of 91714 corpus (74113s/17601h RM) 01/24/04 #counts SARE_OBFU_BREAKTH_SUB 0s/0h of 16895 corpus (14482s/2413h MY) 07/26/04 #counts SARE_OBFU_BREAKTH_SUB 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_OBFU_BREAKTH_SUB 1s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_BREAKTH_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_CASINO_SUB Subject =~ /(?!casinos?)(?!Chaos-info)\b(?:c.?a.?s.?i.?n.?o|(?:c|(?:[\*\xC7\xE7\xA2\xA9]|\xC4[\x86-\x8D]|\xD0\xA1|\xD1\x81))[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[s5\$\xA7]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95))s?\b/i describe SARE_OBFU_CASINO_SUB subject has obfuscated spammer topic score SARE_OBFU_CASINO_SUB 1.028 #ham SARE_OBFU_CASINO_SUB "cats into" #counts SARE_OBFU_CASINO_SUB 35s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_CASINO_SUB 55s/0h of 260791 corpus (115716s/145075h RM) 05/25/05 #counts SARE_OBFU_CASINO_SUB 24s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_CASINO_SUB 29s/0h of 46903 corpus (42982s/3921h MY) 05/09/05 #counts SARE_OBFU_CASINO_SUB 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_OBFU_CASINO_SUB 2s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_OBFU_CASINO_SUB 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_CASINO_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 #body __SARE_OBFU_CIALIS1 /(?!Cialis)\b[cÇ©\(]{1,3}(?:[_\W]{0,5}|[cials])[iÌÍÎÏìíîï\|1l\!](?:[_\W]{0,5}|[cials])[aÀÁÂÃÄÅàáâãäå4\@](?:[_\W]{0,5}|[cials])[l1\!\|£](?:[_\W]{0,5}|[cials])[iÌÍÎÏìíîï\|1l\!](?:[_\W]{0,5}|[cials])[sz5\$]{1,3}\b/i #hist __SARE_OBFU_CIALIS1 Originally MANGLED_CIALIS, by Jennifer Wheeler, 2004 #body __SARE_OBFU_CIALIS2 /(?!\bCIALIS\b)(?!.*15)(?:\b(c)(?:\1){0,2}|\B([\*ýýýý]|\xC4[\x86-\x8D]|\xD0\xA1|\xD1\x81)(?:\2){0,2})[\W\d_]?([il1:\|\*ý-ýý-ýý]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)(?:\3){0,2}[\W\d_]?([a4\*\@ý-ýýý-ý]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)(?:\4){0,2}[\W\d_]?([l1I\|ý]|(?:\xC5[\x80-\x82]|\xC4[\xB9-\xBF]))(?:\5){0,2}[\W\d_]?([il1:\|\*ý-ýý-ýý]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)(?:\6){0,2}[\W\d_]?(?:([s5])(?:\7){0,2}\b|([\$ý]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)(?:\8){0,2}\B)/i #hist __SARE_OBFU_CIALIS2 Bob Menschel, April 2005 #meta SARE_OBFU_CIALIS __SARE_OBFU_CIALIS1 || __SARE_OBFU_CIALIS2 #describe SARE_OBFU_CIALIS found apparent obfuscation of word used in spam #score SARE_OBFU_CIALIS 1.627 #ham SARE_OBFU_CIALIS "cla : class" #counts SARE_OBFU_CIALIS 10172s/59h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_CIALIS 605s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_CIALIS 525s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_CIALIS 262s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_CIALIS 271s/0h of 10829 corpus (6367s/4462h CT) 05/08/05 #counts SARE_OBFU_CIALIS 6s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_CLICK m'(?!click)\bc+[l\|]{1,3}[i1l\|]{1,3}c+k+(?:S+|[e3]{1,3}D+|[i1l\|]{1,3}[nñ]+[g69]{1,3})*'i describe SARE_OBFU_CLICK found apparent obfuscation of word used in spam score SARE_OBFU_CLICK 1.666 #ham SARE_OBFU_CLICK verified (1) #counts SARE_OBFU_CLICK 948s/2h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_CLICK 117s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_CLICK 64s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_CLICK 50s/1h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_CLICK 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_CODEINE m'(?!CODEINE)\bc+[o0]{1,3}d+(?:[i1l\|]|[e3])+[nñ]+[e3]{1,3}'i describe SARE_OBFU_CODEINE found apparent obfuscation of word used in spam score SARE_OBFU_CODEINE 0.833 #ham SARE_OBFU_CODEINE verified (6) #counts SARE_OBFU_CODEINE 61s/2h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_CODEINE 952s/2h of 284851 corpus (112429s/172422h RM) 05/04/05 #counts SARE_OBFU_CODEINE 157s/3h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_CODEINE 49s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_CODEINE 33s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_CODEINE 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_CONSULT_SUB Subject =~ /(?!consultations?)\b(?:consultation|(?:c|(?:[\*\xC7\xE7\xA2\xA9]|\xC4[\x86-\x8D]|\xD0\xA1|\xD1\x81))[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[s5\$\xA7]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[uv\*\xB5\xD9-\xDC\xF9-\xFC]|\xC5[\xA8-\xB3]|\xC6[\xAF-\xB0]|\xC7[\x93-\x9C]|\xCE\xB0|\xCE\xBC|\xCF\x8B|\xCF\x8D|\xD4\xB1|\xD5\x84|\xD5\x8D)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[l1I\|\xA3]|(?:\xC5[\x80-\x82]|\xC4[\xB9-\xBF]))[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[s5\$\xA7]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)?)\b/i describe SARE_OBFU_CONSULT_SUB subject has obfuscated spammer topic score SARE_OBFU_CONSULT_SUB 2.500 #stype SARE_OBFU_CONSULT_SUB obfu #hist SARE_OBFU_CONSULT_SUB Jan 2005: Moved from file 2 back to file 1 #counts SARE_OBFU_CONSULT_SUB 13s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_CONSULT_SUB 13s/0h of 96870 corpus (75474s/21396h RM) 05/08/04 #counts SARE_OBFU_CONSULT_SUB 0s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_CONSULT_SUB 0s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_OBFU_CONSULT_SUB 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_CONSULT_SUB 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_CONSULT_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_COULD m'(?!COULD)\bc+[o0]{1,3}u+[l\|]{1,3}d+\b'i describe SARE_OBFU_COULD found apparent obfuscation of word used in spam score SARE_OBFU_COULD 0.917 #hist SARE_OBFU_COULD verified (1) #counts SARE_OBFU_COULD 198s/8h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_COULD 409s/2h of 284851 corpus (112429s/172422h RM) 05/04/05 #counts SARE_OBFU_COULD 290s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_COULD 1s/0h of 41487 corpus (37599s/3888h MY) 04/18/05 #counts SARE_OBFU_COULD 14s/2h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_COULD 140s/2h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_COULD 4s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_CREDIT_POX m{(?!credit)\bC[-_`~!^&*()=+'";:?.,]?R[-_`~!^&*()=+'";:?.,]?[e3][-_`~!^&*()=+'";:?.,]?D[-_`~!^&*()=+'";:?.,]?[i1l\|][-_`~!^&*()=+'";:?.,]?T\b}i describe SARE_OBFU_CREDIT_POX found apparent obfuscation of word used in spam score SARE_OBFU_CREDIT_POX 0.889 #ham SARE_OBFU_CREDIT_POX confirmed (1) #hist SARE_OBFU_CREDIT_POX Bob Menschel, Apr 23 2005 #counts SARE_OBFU_CREDIT_POX 84s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_CREDIT_POX 342s/0h of 290849 corpus (122033s/168816h RM) 05/01/05 #counts SARE_OBFU_CREDIT_POX 29s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_CREDIT_POX 5s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_CREDIT_POX 18s/0h of 10828 corpus (6369s/4459h CT) 05/02/05 #counts SARE_OBFU_CREDIT_POX 2s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 body SARE_OBFU_DOLLARS m'(?!DOLLARS)\bd+[o0]{1,3}[l\|]{1,3}[l\|]{1,3}(?:[a\@4åä]|/\\){1,3}r+s+\b'i describe SARE_OBFU_DOLLARS found apparent obfuscation of word used in spam score SARE_OBFU_DOLLARS 1.666 #ham SARE_OBFU_DOLLARS misspelled: dolllars (3 Ls) #counts SARE_OBFU_DOLLARS 4128s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_DOLLARS 301s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_DOLLARS 24s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_DOLLARS 24s/0h of 43978 corpus (40095s/3883h MY) 05/01/05 #counts SARE_OBFU_DOLLARS 46s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_DOLLARS 150s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_DOLLARS 23s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_DOWNLD_SUB Subject =~ /(?!down ?load)(?:d.?o.?w.?n.?l.?o.?a.?d|(?:d|(?:[\xD0]|\xC4[\x8E-\x91]))(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)(?:w|\\\/\\\/|VV|\xC5[\xB4-\xB5]|\xCF[\x88-\x89]|\xCF\x8E])(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)(?:[l1I\|\xA3]|(?:\xC5[\x80-\x82]|\xC4[\xB9-\xBF]))(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)(?:[d\xD0]|\xC4[\x8E-\x91]))/i describe SARE_OBFU_DOWNLD_SUB subject has obfuscated spammer topic score SARE_OBFU_DOWNLD_SUB 0.850 #ham SARE_OBFU_DOWNLD_SUB extra space inserted by accident #counts SARE_OBFU_DOWNLD_SUB 8s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_DOWNLD_SUB 62s/0h of 283414 corpus (129902s/153512h RM) 03/08/05 #counts SARE_OBFU_DOWNLD_SUB 8s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_OBFU_DOWNLD_SUB 0s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_DOWNLD_SUB 9s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_DOWNLD_SUB 7s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_DOWNLD_SUB 34s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_DOWNLD_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_EXCL_SUB Subject =~ /(?!exclusive)\b(?:e.?x.?c.?l.?u.?s.?i.?v.?e|[e3\*\xC8-\xCB\xE8-\xEB][\W_]?[x\xD7][\W_]?[c\xC7\xE7\xA2\xA9][\W_]?[l1I\|\xA3][\W_]?[uv\*\xB5\xD9-\xDC\xF9-\xFC][\W_]?[s5\$\xA7][\W_]?[il1:\|\*\xCC-\xCF\xEC-\xEF][\W_]?[vu][\W_]?[e3\*\xC8-\xCB\xE8-\xEB])\b/i describe SARE_OBFU_EXCL_SUB subject has obfuscated spammer topic score SARE_OBFU_EXCL_SUB 1.666 #stype SARE_OBFU_EXCL_SUB obfu #counts SARE_OBFU_EXCL_SUB 0s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_EXCL_SUB 14s/0h of 97268 corpus (79437s/17831h RM) 01/24/04 #counts SARE_OBFU_EXCL_SUB 1s/0h of 47845 corpus (43810s/4035h MY) 05/28/05 #max SARE_OBFU_EXCL_SUB 2s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_OBFU_EXCL_SUB 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_OBFU_EXCL_SUB 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_EXCL_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_SUB_FOR_OB Subject =~ /(?!For)\bf[\W_]?(?:\[\]|\(\)|[o0\*\xD2-\xD6\xF2-\xF6])[\W_]?[r\xAE]\b/i describe SARE_SUB_FOR_OB subject has obfuscated spammer topic score SARE_SUB_FOR_OB 0.492 #stype SARE_SUB_FOR_OB obfu #ham SARE_SUB_FOR_OB typo ("xxxx fo r xxxx") #counts SARE_SUB_FOR_OB 51s/4h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_FOR_OB 7s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_FOR_OB 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_FOR_OB 13s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_FOR_OB 4s/2h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_SUB_FOR_OB 15s/2h of 11030 corpus (6598s/4432h CT) 03/10/05 body SARE_OBFU_GOALS m'(?!GO+ALS?)\b[g69]+[o0]+(?:[a\@4åä]|/\\)+[l\|]+s*\b'i describe SARE_OBFU_GOALS found apparent obfuscation of word used in spam score SARE_OBFU_GOALS 0.893 #ham SARE_OBFU_GOALS confirmed (2): Goooooal, 904L #counts SARE_OBFU_GOALS 150s/4h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_GOALS 313s/0h of 295111 corpus (124249s/170862h RM) 04/19/05 #counts SARE_OBFU_GOALS 144s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_GOALS 1s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_GOALS 9s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_GOALS 65s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_GOALS 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 #body SARE_OBFU_GUARANTEE /(?!\bguarantee\b)(?:\b([g69])(?:\1){0,2}|\B(\xC4[\x9C-\xA3])(?:\2){0,2})[\W\d_]?([uv\*ýý-ýý-ý]|\xC5[\xA8-\xB3]|\xC6[\xAF-\xB0]|\xC7[\x93-\x9C]|\xCE\xB0|\xCE\xBC|\xCF\x8B|\xCF\x8D|\xD4\xB1|\xD5\x84|\xD5\x8D)(?:\3){0,2}[\W\d_]?([a4\*\@ý-ýýý-ý]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)(?:\4){0,2}[\W\d_]?([rý]|\xC5[\x94-\x99]|\xD1\x93)(?:\5){0,2}[\W\d_]?([a4\*\@ý-ýýý-ý]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)(?:\6){0,2}[\W\d_]?([nýý]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)(?:\7){0,2}[\W\d_]?([t\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)(?:\8){0,2}[\W\d_]?([e3\*ý-ýý-ý]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)(?:\9){0,2}[\W\d_]?(?:([e3])(?:\10){0,2}\b|([\*ý-ýý-ý]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)(?:\11){0,2}\B)/i #describe SARE_OBFU_GUARANTEE found apparent obfuscation of word used in spam #score SARE_OBFU_GUARANTEE 1.666 #ham SARE_OBFU_GUARANTEE verified (1) #counts SARE_OBFU_GUARANTEE 490s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_GUARANTEE 1260s/0h of 299858 corpus (141237s/158621h RM) 07/12/05 #counts SARE_OBFU_GUARANTEE 188s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_GUARANTEE 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_GUARANTEE 32s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_GUARANTEE 139s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_GUARANTEE 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_HARD_SUB Subject =~ /(?!hCard)(?!h[eo]?are?d)(?!ha[it]?red)(?!Hagrid)\b(?:h.?a.?r.?d|h[\W_]?[a4\*\@\xC0-\xC5\xAA\xE0-\xE5][\W_]?[r\xAE][\W_]?[d\xD0])\b/i describe SARE_OBFU_HARD_SUB subject has obfuscated spammer topic score SARE_OBFU_HARD_SUB 0.444 #hist SARE_OBFU_HARD_SUB Added exclusions for hatred, haired, hared, hoard, hoared, Feb 6 2005 #hist SARE_OBFU_HARD_SUB Added exclusion for Hagrid, Apr 22 2005, hcard Oct 1 2005 #counts SARE_OBFU_HARD_SUB 6s/19h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_HARD_SUB 30s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_OBFU_HARD_SUB 3s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_OBFU_HARD_SUB 7s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_OBFU_HARD_SUB 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_OBFU_HARD_SUB 11s/0h of 16895 corpus (14482s/2413h MY) 07/26/04 #counts SARE_OBFU_HARD_SUB 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_HARD_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_HOMEOWN_SUB Subject =~ /(?!home[-_ ]?owner)(?:h.?o.?m.?e.?o.?w.?n.?e.?r|(?:h|\xC4[\xA4-\xA7]|\xCE\x89|\xCE\x97|\xD0\x9D|\xD0\xBD|\xD1\x92|\xD2[\xA2-\xA3]|\xD2[\xBA-\xBB]|\xD5\xB0])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:m|rn|\/V\\|\/\\\/\\|\xCE\x9C|\xD0\x9C|\xD0\xBC])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:w|\\\/\\\/|VV|\xC5[\xB4-\xB5]|\xCF[\x88-\x89]|\xCF\x8E])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93))/i describe SARE_OBFU_HOMEOWN_SUB subject has obfuscated spammer topic score SARE_OBFU_HOMEOWN_SUB 0.194 #ham SARE_OBFU_HOMEOWN_SUB confirmed (1) -- misspelled #hist SARE_OBFU_HOMEOWN_SUB Added exclusion for _ and space between words #hist SARE_OBFU_HOMEOWN_SUB May 28 2005: Added exclusion for - between words #counts SARE_OBFU_HOMEOWN_SUB 6s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_HOMEOWN_SUB 12s/0h of 299858 corpus (141237s/158621h RM) 07/12/05 #counts SARE_OBFU_HOMEOWN_SUB 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_OBFU_HOMEOWN_SUB 1s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_HOMEOWN_SUB 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_OBFU_HOMEOWN_SUB 2s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_OBFU_HOMEOWN_SUB 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_HOMEOWN_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_INKJET_SUB Subject =~/(?!Ink ?jet)(?:i.?n.?k.?j.?e.?t|(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:k|\xC4[\xB6-\xB8]|\xCE\x9A|\xCE\xBA|\xD0\x8C|\xD0\x9A|\xD0\xBA|\xD1\x9C|\xD2[\x9A-\x9D]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:j|\xC4[\xB4-\xB5]|\xD0\x88|\xD1\x98])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82))/i describe SARE_OBFU_INKJET_SUB subject has obfuscated spammer topic score SARE_OBFU_INKJET_SUB 1.666 #stype SARE_OBFU_INKJET_SUB obfu #hist SARE_OBFU_INKJET_SUB added optional space between two words, Mar 2005 #counts SARE_OBFU_INKJET_SUB 0s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #max SARE_OBFU_INKJET_SUB 12s/0h of 91714 corpus (74113s/17601h RM) 01/24/04 #counts SARE_OBFU_INKJET_SUB 3s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_OBFU_INKJET_SUB 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_OBFU_INKJET_SUB 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_OBFU_INKJET_SUB 1s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_INKJET_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_MILLIONS m'(?!\w+ILLIONs?)\b[a-z]{1,3}[i1l\|]{1,3}[l\|]{1,3}[l\|]{1,3}[i1l\|]{1,3}[o0]{1,3}[nñ]{1,3}s*\b'i describe SARE_OBFU_MILLIONS found apparent obfuscation of word used in spam score SARE_OBFU_MILLIONS 1.213 #ham SARE_OBFU_MILLIONS verified (5) #hist SARE_OBFU_MILLIONS Bob Menschel, Apr 15 2005, added Billion Apr 23 2005 #counts SARE_OBFU_MILLIONS 506s/6h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_MILLIONS 806s/5h of 284851 corpus (112429s/172422h RM) 05/04/05 #counts SARE_OBFU_MILLIONS 320s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_MILLIONS 69s/1h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_MILLIONS 28s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_MILLIONS 149s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_MILLIONS 24s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_MOVE_SUB Subject =~ /(?!move)\b(?:\/\\\/\\|\/V\\|rn|[m])[\W_]?(?:\[\]|\(\)|[o0\*\xD2-\xD6\xF2-\xF6])[\W_]?[vu][\W_]?[e3\*\xC8-\xCB\xE8-\xEB]/i describe SARE_OBFU_MOVE_SUB subject has obfuscated spammer topic score SARE_OBFU_MOVE_SUB 0.722 #ham SARE_OBFU_MOVE_SUB confirmed (1) #counts SARE_OBFU_MOVE_SUB 29s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_MOVE_SUB 1s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_MOVE_SUB 1s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_MOVE_SUB 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_OBFU_MOVE_SUB 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_MOVE_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_ONLINE m{(?!on[- ]?line)\b[o0]{1,3}[nñ]+[l\|]{1,3}[i1l\|]{1,3}[nñ]+[e3]{1,3}(?:R[-_`~!^&*()=+'";:?.,]?X)?}i describe SARE_OBFU_ONLINE found apparent obfuscation of word used in spam score SARE_OBFU_ONLINE 1.666 #counts SARE_OBFU_ONLINE 1537s/5h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_ONLINE 1621s/2h of 284851 corpus (112429s/172422h RM) 05/04/05 #counts SARE_OBFU_ONLINE 305s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_ONLINE 111s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_ONLINE 32s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_ONLINE 62s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_ONLINE 3s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_ORDERING_SPL m'\b(?:odrer|orrde)(?:ing)?\b'i describe SARE_OBFU_ORDERING_SPL found apparent obfuscation of word used in spam score SARE_OBFU_ORDERING_SPL 0.614 #ham SARE_OBFU_ORDERING_SPL verified (1) #hist SARE_OBFU_ORDERING_SPL Bob Menschel, Apr 24 2005 #counts SARE_OBFU_ORDERING_SPL 8s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_ORDERING_SPL 119s/0h of 284851 corpus (112429s/172422h RM) 05/04/05 #counts SARE_OBFU_ORDERING_SPL 9s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_ORDERING_SPL 24s/0h of 10829 corpus (6367s/4462h CT) 05/08/05 #counts SARE_OBFU_ORDERING_SPL 2s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_ORDERING_SPL 18s/0h of 46903 corpus (42982s/3921h MY) 05/09/05 #counts SARE_OBFU_ORDERING_SPL 2s/0h of 4677 corpus (810s/3867h ft) 05/28/05 body SARE_OBFU_PHARM m'(?!pharm(?:ac(?:y|ies))?)\bp+h+(?:[a\@4åä]|/\\){1,3}r+(?:m|rn)+(?:(?:[a\@4åä]|/\\){1,3}c+(?:y+|[i1l\|]{1,3}[e3]{1,3}s+))?'i describe SARE_OBFU_PHARM found apparent obfuscation of word used in spam score SARE_OBFU_PHARM 2.222 #counts SARE_OBFU_PHARM 913s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PHARM 1565s/0h of 295111 corpus (124249s/170862h RM) 04/19/05 #counts SARE_OBFU_PHARM 53s/1h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_PHARM 282s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_PHARM 11s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PHARM 21s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_PHARM 2s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 body SARE_OBFU_PHARM_POX m{(?!phar-?m(?:ac(?:y|ies))?)\bp+[-_`~!^&*()=+'";:?.,]?h+[-_`~!^&*()=+'";:?.,]?(?:[a\@4åä]|/\\){1,3}[-_`~!^&*()=+'";:?.,]?r+[-_`~!^&*()=+'";:?.,]?(?:m|rn)+[-_`~!^&*()=+'";:?.,]?(?:(?:[a\@4åä]|/\\){1,3}[-_`~!^&*()=+'";:?.,]?c+[-_`~!^&*()=+'";:?.,]?(?:y+|[i1l\|]{1,3}[-_`~!^&*()=+'";:?.,]?[e3]{1,3}[-_`~!^&*()=+'";:?.,]?s+))?}i describe SARE_OBFU_PHARM_POX found apparent obfuscation of word used in spam score SARE_OBFU_PHARM_POX 1.666 #counts SARE_OBFU_PHARM_POX 1094s/2h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PHARM_POX 1875s/0h of 295111 corpus (124249s/170862h RM) 04/19/05 #counts SARE_OBFU_PHARM_POX 86s/1h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_PHARM_POX 298s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_PHARM_POX 28s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PHARM_POX 61s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_PHARM_POX 2s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 body SARE_OBFU_PHARM_SPL m'(?!Pharmacy)P(?:har|ahr)(?:am|ma)cy'i describe SARE_OBFU_PHARM_SPL found apparent obfuscation of word used in spam score SARE_OBFU_PHARM_SPL 1.666 #hist SARE_OBFU_PHARM_SPL Added additional misspellings, Apr 25 2005 #counts SARE_OBFU_PHARM_SPL 355s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PHARM_SPL 971s/0h of 284851 corpus (112429s/172422h RM) 05/04/05 #counts SARE_OBFU_PHARM_SPL 4s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_PHARM_SPL 129s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_PHARM_SPL 140s/0h of 47845 corpus (43810s/4035h MY) 05/28/05 #counts SARE_OBFU_PHARM_SPL 10s/2h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_PHARM_SPL 2s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 header SARE_OBFU_PHYSN_SUB Subject =~ /(?!physicians?)\b(?:physicians?|(?:p|(?:[\xDE]|\xCE\xA1|\xCF\x81|\xD0\xA0|\xD1\x80))[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:h|\xC4[\xA4-\xA7]|\xCE\x89|\xCE\x97|\xD0\x9D|\xD0\xBD|\xD1\x92|\xD2[\xA2-\xA3]|\xD2[\xBA-\xBB]|\xD5\xB0])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[y\xA5\xDD\xFD]|\xC5[\xB6-\xB8]|\xCE\x8E|\xCE\xA5|\xCE\xA8|\xCE\xAB|\xCE\xB3|\xD0\xA3|\xD1\x83|\xD1\x9E|\xD2[\xAE-\xB1])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[s5\$\xA7]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[c\*\xC7\xE7\xA2\xA9]|\xC4[\x86-\x8D]|\xD0\xA1|\xD1\x81)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[s5\$\xA7]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)?)\b/i describe SARE_OBFU_PHYSN_SUB subject has obfuscated spammer topic score SARE_OBFU_PHYSN_SUB 1.666 #stype SARE_OBFU_PHYSN_SUB obfu #counts SARE_OBFU_PHYSN_SUB 1s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PHYSN_SUB 4s/0h of 114221 corpus (81067s/33154h RM) 01/15/05 #counts SARE_OBFU_PHYSN_SUB 0s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_PHYSN_SUB 0s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_OBFU_PHYSN_SUB 2s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_OBFU_PHYSN_SUB 3s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_PHYSN_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_PLEASE_SUB Subject =~ /(?!Please)\b(?:p.?l.?e.?a.?s.?e|p[\W_]?[l1I\|\xA3][\W_]?[e3\*\xC8-\xCB\xE8-\xEB][\W_]?[a4\*\@\xC0-\xC5\xAA\xE0-\xE5][\W_]?[s5\$\xA7][\W_]?[e3\*\xC8-\xCB\xE8-\xEB])\b/i describe SARE_OBFU_PLEASE_SUB subject has obfuscated spammer topic score SARE_OBFU_PLEASE_SUB 1.666 #stype SARE_OBFU_PLEASE_SUB obfu #counts SARE_OBFU_PLEASE_SUB 1s/0h of 280895 corpus (109565s/171330h RM) 05/03/05 #max SARE_OBFU_PLEASE_SUB 6s/0h of 114221 corpus (81067s/33154h RM) 01/15/05 #counts SARE_OBFU_PLEASE_SUB 0s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_PLEASE_SUB 2s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_PLEASE_SUB 0s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_OBFU_PLEASE_SUB 1s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_PLEASE_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_PHOTOS_SUB Subject =~ /(?!pho ?tos?)\b(?:p.?h.?o.?t.?os?|p[\W_]?h[\W_]?(?:\[\]|\(\)|[o0\*\xD2-\xD6\xF2-\xF6])[\W_]?t[\W_]?(?:\[\]|\(\)|[o0\*\xD2-\xD6\xF2-\xF6])[\W_]?[s5\$\xA7]?)/i describe SARE_OBFU_PHOTOS_SUB subject has obfuscated spammer topic score SARE_OBFU_PHOTOS_SUB 0.872 #stype SARE_OBFU_PHOTOS_SUB obfu #counts SARE_OBFU_PHOTOS_SUB 4s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PHOTOS_SUB 73s/1h of 283414 corpus (129902s/153512h RM) 03/08/05 #counts SARE_OBFU_PHOTOS_SUB 53s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_OBFU_PHOTOS_SUB 0s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_PHOTOS_SUB 14s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_PHOTOS_SUB 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_PHOTOS_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 #body SARE_OBFU_PRESCR_SPL1 /([p\xDE]|\xCE\xA1|\xCF\x81|\xD0\xA0|\xD1\x80)(?:\1){0,2}[\W_]?([e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)(?:\2){0,2}[\W_]?([r\xAE]|\xC5[\x94-\x99]|\xD1\x93)(?:\3){0,2}[\W_]?([s5\$\xA7]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)(?:\4){0,2}[\W_]?([c\*\xC7\xE7\xA2\xA9]|\xC4[\x86-\x8D]|\xD0\xA1|\xD1\x81)(?:\5){0,2}[\W_]?([r\xAE]|\xC5[\x94-\x99]|\xD1\x93)(?:\6){0,2}[\W_]?([il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)(?:\7){0,2}[\W_]?([p\xDE]|\xCE\xA1|\xCF\x81|\xD0\xA0|\xD1\x80)(?:\8){0,2}[\W_]?([t\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)(?:\9){0,2}[\W_]?([il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)(?:\10){0,2}[\W_]?([o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)(?:\11){0,2}[\W_]?([n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)(?:\12){0,2}/i #describe SARE_OBFU_PRESCR_SPL1 Obfuscated 'perscription' in body #score SARE_OBFU_PRESCR_SPL1 0.266 #ham SARE_OBFU_PRESCR_SPL1 "perscription" #counts SARE_OBFU_PRESCR_SPL1 98s/20h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PRESCR_SPL1 136s/1h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_PRESCR_SPL1 10s/3h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PRESCR_SPL1 17s/3h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_PRESCR_SPL1 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 #counts SARE_OBFU_PRESCR_SPL1 7s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_PRESCR_SPL1 14s/0h of 45520 corpus (41534s/3986h MY) 05/16/05 #body SARE_OBFU_PRESCRIP /(?!\bprescription)(?:\b(p)(?:\1){0,2}|\B([\xDE]|\xCE\xA1|\xCF\x81|\xD0\xA0|\xD1\x80)(?:\2){0,2})[\W\d_]?([r\xAE]|\xC5[\x94-\x99]|\xD1\x93)(?:\3){0,2}[\W\d_]?([e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)(?:\4){0,2}[\W\d_]?([s5\$\xA7]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)(?:\5){0,2}[\W\d_]?r?([c\*\xC7\xE7\xA2\xA9]|\xC4[\x86-\x8D]|\xD0\xA1|\xD1\x81)(?:\6){0,2}[\W\d_]?([r\xAE]|\xC5[\x94-\x99]|\xD1\x93)(?:\7){0,2}[\W\d_]?([il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)(?:\8){0,2}[\W\d_]?([p\xDE]|\xCE\xA1|\xCF\x81|\xD0\xA0|\xD1\x80)(?:\9){0,2}[\W\d_]?([t\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)(?:\10){0,2}[\W\d_]?([il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)(?:\11){0,2}[\W\d_]?([o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)(?:\12){0,2}[\W\d_]?([n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)(?:\13){0,2}/i #describe SARE_OBFU_PRESCRIP found apparent obfuscation of word used in spam #score SARE_OBFU_PRESCRIP 0.669 #ham SARE_OBFU_PRESCRIP frequent misspellings #counts SARE_OBFU_PRESCRIP 624s/40h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PRESCRIP 835s/41h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_PRESCRIP 82s/1h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PRESCRIP 222s/1h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_PRESCRIP 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 #counts SARE_OBFU_PRESCRIP 151s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #body __SARE_OBFU_PRICE1 /(?!\bpric(?:e(?:d|s)?|ing)\b)(?:\b(p)(?:\1){0,2}|\B([ý]|\xCE\xA1|\xCF\x81|\xD0\xA0|\xD1\x80)(?:\2){0,2})[\W\d_]?([rý]|\xC5[\x94-\x99]|\xD1\x93)(?:\3){0,2}[\W\d_]?([il1:\|\*ý-ýý-ýý]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)(?:\4){0,2}[\W\d_]?([c\*ýýýý]|\xC4[\x86-\x8D]|\xD0\xA1|\xD1\x81)(?:\5){0,2}(?:([e3\*ý-ýý-ý]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)(?:\6){0,2}(?:([dý]|\xC4[\x8E-\x91])(?:\7){0,2}|([s5\$ý]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)(?:\8){0,2})?|([il1:\|\*ý-ýý-ýý]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)(?:\9){0,2}[\W\d_]?([nýý]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)(?:\10){0,2}[\W\d_]?([g69]|\xC4[\x9C-\xA3]])(?:\11){0,2})\b/i #counts __SARE_OBFU_PRICE1 5027s/2h of 290849 corpus (122033s/168816h RM) 05/01/05 #counts __SARE_OBFU_PRICE1 295s/0h of 43978 corpus (40095s/3883h MY) 05/01/05 #counts __SARE_OBFU_PRICE1 101s/0h of 10828 corpus (6369s/4459h CT) 05/02/05 #body __SARE_OBFU_PRICE_NUM m{(?!PRIC(?:E[DS]?|ing))\bP\d?R\d?I\d?C\d?(?:E\d?[DS]?|I\d?N\d?G)\b}i #counts __SARE_OBFU_PRICE_NUM 522s/0h of 282751 corpus (111071s/171680h RM) 05/02/05 #counts __SARE_OBFU_PRICE_NUM 24s/0h of 43978 corpus (40095s/3883h MY) 05/01/05 #counts __SARE_OBFU_PRICE_NUM 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts __SARE_OBFU_PRICE_NUM 0s/0h of 10828 corpus (6369s/4459h CT) 05/02/05 #meta SARE_OBFU_PRICE1 __SARE_OBFU_PRICE1 && __SARE_OBFU_PRICE_NUM #describe SARE_OBFU_PRICE1 found apparent obfuscation of word used in spam #score SARE_OBFU_PRICE1 2.666 #counts SARE_OBFU_PRICE1 323s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PRICE1 691s/0h of 299858 corpus (141237s/158621h RM) 07/12/05 #counts SARE_OBFU_PRICE1 126s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_PRICE1 0s/0h of 10828 corpus (6369s/4459h CT) 05/02/05 #counts SARE_OBFU_PRICE1 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 #meta SARE_OBFU_PRICE2 __SARE_OBFU_PRICE1 && !__SARE_OBFU_PRICE_NUM #describe SARE_OBFU_PRICE2 found apparent obfuscation of word used in spam #score SARE_OBFU_PRICE2 1.666 #counts SARE_OBFU_PRICE2 10726s/3h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PRICE2 839s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_PRICE2 57s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PRICE2 104s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_PRICE2 7s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 body SARE_OBFU_PUBLICATION m'(?!PUBLICATIONs?)\bp+u+b+[l\|]{1,3}[i1l\|]{1,3}c+(?:[a\@4åä]|/\\){1,3}t+[i1l\|]{1,3}[o0]{1,3}[nñ]+s*\b'i describe SARE_OBFU_PUBLICATION found apparent obfuscation of word used in spam score SARE_OBFU_PUBLICATION 1.666 #ham SARE_OBFU_PUBLICATION verified (3) #counts SARE_OBFU_PUBLICATION 22s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PUBLICATION 612s/0h of 284851 corpus (112429s/172422h RM) 05/04/05 #counts SARE_OBFU_PUBLICATION 241s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_PUBLICATION 0s/0h of 41487 corpus (37599s/3888h MY) 04/18/05 #counts SARE_OBFU_PUBLICATION 12s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PUBLICATION 67s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_PUBLICATION 5s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_REAL_SUB Subject =~ /(?!re[ct ]?ai?ll?)\b(?:r.?e.?a.?l|[r\xAE][\W_]?[e3\*\xC8-\xCB\xE8-\xEB][\W_]?[a4\*\@\xC0-\xC5\xAA\xE0-\xE5][\W_]?[l1I\|\xA3])\b/i describe SARE_OBFU_REAL_SUB subject has obfuscated spammer topic score SARE_OBFU_REAL_SUB 0.676 #ham SARE_OBFU_REAL_SUB "They're All a Bunch of ..." #counts SARE_OBFU_REAL_SUB 104s/4h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_REAL_SUB 2s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_OBFU_REAL_SUB 3s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_OBFU_REAL_SUB 2s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_REAL_SUB 6s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_REAL_SUB 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_REAL_SUB 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_REAL_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_REFINANC_NUM m'(?!REFINANCE)\br\d?e\d?f\d?i\d?n\d?a\d?n\d?c\d?e\d?s?\b'i describe SARE_OBFU_REFINANC_NUM found apparent obfuscation of word used in spam score SARE_OBFU_REFINANC_NUM 0.555 #stype SARE_OBFU_REFINANC_NUM spamp #counts SARE_OBFU_REFINANC_NUM 1s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_REFINANC_NUM 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_REFINANC_NUM 1s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_REFINANC_NUM 0s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_REFINANC_NUM 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_RELEASES m'(?!release?(?:s+|[i1l\|]{1,3}[nñ]+[g69]{1,3}|[e3]{1,3}d+)?)\br+[e3]{1,3}[l\|]{1,3}[e3]{1,3}(?:[a\@4åä]|/\\){1,3}s+e*(?:s+|[i1l\|]{1,3}[nñ]+[g69]{1,3}|[e3]{1,3}d+)?\b'i describe SARE_OBFU_RELEASES found apparent obfuscation of word used in spam score SARE_OBFU_RELEASES 0.994 #ham SARE_OBFU_RELEASES confirmed (3) #counts SARE_OBFU_RELEASES 88s/3h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_RELEASES 344s/0h of 295111 corpus (124249s/170862h RM) 04/19/05 #counts SARE_OBFU_RELEASES 211s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_RELEASES 0s/0h of 41487 corpus (37599s/3888h MY) 04/18/05 #counts SARE_OBFU_RELEASES 15s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_RELEASES 123s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_RELEASES 2s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_RELIABLE m'(?!reliabl[ey])\br+[e3]+[l\|]+[i1l\|]+(?:[a\@4åä]|/\\)+b+[l\|]+(?:e|y)+\b'i describe SARE_OBFU_RELIABLE found apparent obfuscation of word used in spam score SARE_OBFU_RELIABLE 1.386 #ham SARE_OBFU_RELIABLE confirmed (1) #counts SARE_OBFU_RELIABLE 85s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_RELIABLE 287s/0h of 295111 corpus (124249s/170862h RM) 04/19/05 #counts SARE_OBFU_RELIABLE 205s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_RELIABLE 0s/0h of 41487 corpus (37599s/3888h MY) 04/18/05 #counts SARE_OBFU_RELIABLE 6s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_RELIABLE 80s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_RELIABLE 3s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_RESULTING m'(?!rr?esult(?:s+|[i1l\|]+[nñ]+[g69]+|[e3]+d+)?)\br+[e3]+s+u+[l\|]+t+(?:s+|[i1l\|]+[nñ]+[g69]+|[e3]+d+)?\b'i describe SARE_OBFU_RESULTING found apparent obfuscation of word used in spam score SARE_OBFU_RESULTING 1.666 #ham SARE_OBFU_RESULTING misspelling #counts SARE_OBFU_RESULTING 94s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_RESULTING 681s/0h of 282751 corpus (111071s/171680h RM) 05/02/05 #counts SARE_OBFU_RESULTING 319s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_RESULTING 2s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_RESULTING 18s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_RESULTING 149s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_RESULTING 5s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_SHOULD m'(?!should)\bs+h+[o0]{1,3}u+[l\|]{1,3}d+\b'i describe SARE_OBFU_SHOULD found apparent obfuscation of word used in spam score SARE_OBFU_SHOULD 1.624 #ham SARE_OBFU_SHOULD verified (1) #counts SARE_OBFU_SHOULD 212s/2h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_SHOULD 560s/1h of 284851 corpus (112429s/172422h RM) 05/04/05 #counts SARE_OBFU_SHOULD 315s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_SHOULD 3s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_SHOULD 20s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_SHOULD 112s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_SHOULD 27s/0h of 2202 corpus (356s/1846h ft) 05/16/05 #body __SARE_OBFU_SOFT1 m'(?!SOFT)\bs+[o0]{1,3}f+t+'i #body __SARE_OBFU_SOFT2 /(?!\bsoft(?:er|ww?are)\b)(?:\b([s5])(?:\1){0,2}|\B([\$ý]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)(?:\2){0,2})[\W\d_]?([o0\*ýýýýý-ýý-ý]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)(?:\3){0,2}[\W\d_]?(f|\xC5\xBF|\xC6\x92|\xD2[\x92-\x93]])(?:\4){0,2}[\W\d_]?([t\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)(?:\5){0,2}(?:([e3\*ý-ýý-ý]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)(?:\6){0,2}[\W\d_]?([rý]|\xC5[\x94-\x99]|\xD1\x93)(?:\7){0,2}|(w|\\\/\\\/|VV|\xC5[\xB4-\xB5]|\xCF[\x88-\x89]|\xCF\x8E])(?:\8){0,2}[\W\d_]?([a4\*\@ý-ýýý-ý]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)(?:\9){0,2}[\W\d_]?([rý]|\xC5[\x94-\x99]|\xD1\x93)(?:\10){0,2}[\W\d_]?([e3\*ý-ýý-ý]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)(?:\11){0,2})\b/i #meta SARE_OBFU_SOFT __SARE_OBFU_SOFT1 || __SARE_OBFU_SOFT2 #describe SARE_OBFU_SOFT found apparent obfuscation of word used in spam #score SARE_OBFU_SOFT 1.666 #ham SARE_OBFU_SOFT misspelled #counts SARE_OBFU_SOFT 2888s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_SOFT 104s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_SOFT 11s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_SOFT 43s/0h of 47845 corpus (43810s/4035h MY) 05/28/05 #counts SARE_OBFU_SOFT 104s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_SOFT 118s/0h of 10828 corpus (6369s/4459h CT) 05/02/05 #counts SARE_OBFU_SOFT 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_SOMA m'(?!somm?a)\bs+[o0]+(?:m|rn)+(?:[a\@4åä]|/\\)+\b'i describe SARE_OBFU_SOMA found apparent obfuscation of word used in spam score SARE_OBFU_SOMA 1.666 #ham SARE_OBFU_SOMA Spanish: sorna (sarcasm) #hist SARE_OBFU_SOMA Bob Menschel, April 2005 #overlap SARE_OBFU_SOMA Replaces Jennifer Wheeler's MANGLED_SOMA (hits approx same spam, fewer ham) #counts SARE_OBFU_SOMA 170s/1h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_SOMA 922s/0h of 282751 corpus (111071s/171680h RM) 05/02/05 #counts SARE_OBFU_SOMA 177s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_SOMA 61s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_SOMA 65s/0h of 45520 corpus (41534s/3986h MY) 05/16/05 #counts SARE_OBFU_SOMA 21s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_SOMA 24s/0h of 10828 corpus (6369s/4459h CT) 05/02/05 #counts SARE_OBFU_SOMA 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_STOCKS m'(?!STOCKS)\bs+t+[o0]c+k+s+\b'i describe SARE_OBFU_STOCKS found apparent obfuscation of word used in spam score SARE_OBFU_STOCKS 1.666 #ham SARE_OBFU_STOCKS confirmed (1): Misspelled #counts SARE_OBFU_STOCKS 9573s/2h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_STOCKS 38s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_STOCKS 91s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_STOCKS 11s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_STOCKS 25s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_STOCKS 12s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_STRONG_SUB Subject =~ /(?!strong)\b(?:s.?t.?r.?o.?n.?g|(?:[s5]|(?:[\$\xA7]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F))[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[g69]\b|(?:\xC4[\x9C-\xA3])))/i describe SARE_OBFU_STRONG_SUB found apparent obfuscation of word used in spam score SARE_OBFU_STRONG_SUB 1.666 #stype SARE_OBFU_STRONG_SUB obfu #counts SARE_OBFU_STRONG_SUB 3s/0h of 260791 corpus (115716s/145075h RM) 05/25/05 #max SARE_OBFU_STRONG_SUB 11s/0h of 114221 corpus (81067s/33154h RM) 01/15/05 #counts SARE_OBFU_STRONG_SUB 0s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_STRONG_SUB 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_OBFU_STRONG_SUB 5s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_OBFU_STRONG_SUB 1s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_STRONG_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_TECHNOLOGIES m'(?!technolog(?:y|ies))\bt+[e3]{1,3}c+h+[nñ]+[o0]{1,3}[l\|]{1,3}[o0]{1,3}[g69]{1,3}(?:y+|[i1l\|]{1,3}[e3]{1,3}s+)\b'i describe SARE_OBFU_TECHNOLOGIES found apparent obfuscation of word used in spam score SARE_OBFU_TECHNOLOGIES 1.604 #ham SARE_OBFU_TECHNOLOGIES verified (1) #counts SARE_OBFU_TECHNOLOGIES 250s/2h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_TECHNOLOGIES 605s/2h of 284851 corpus (112429s/172422h RM) 05/04/05 #counts SARE_OBFU_TECHNOLOGIES 275s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_TECHNOLOGIES 2s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_TECHNOLOGIES 11s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_TECHNOLOGIES 102s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_TECHNOLOGIES 28s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_VALIUM m'(?!VALIUM)(?:[vw]|\\/){1,3}(?:[a\@4åä]|/\\){1,3}[l\|]{1,3}[i1l\|]{1,3}u+(?:m|rn)+'i describe SARE_OBFU_VALIUM found apparent obfuscation of word used in spam score SARE_OBFU_VALIUM 1.666 #counts SARE_OBFU_VALIUM 316s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_VALIUM 3612s/0h of 284851 corpus (112429s/172422h RM) 05/04/05 #counts SARE_OBFU_VALIUM 414s/1h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_VALIUM 199s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_VALIUM 78s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_VALIUM 143s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_VALIUM 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_VALUE m'(?!value)\b(?:[vw]|\\/){1,3}(?:[a\@4åä]|/\\){1,3}[l\|]{1,3}u+[e3]{1,3}'i describe SARE_OBFU_VALUE found apparent obfuscation of word used in spam score SARE_OBFU_VALUE 0.525 #ham SARE_OBFU_VALUE verified (many in programming code) #counts SARE_OBFU_VALUE 57s/26h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_VALUE 421s/1h of 274568 corpus (109718s/164850h RM) 05/09/05 #counts SARE_OBFU_VALUE 175s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_VALUE 3s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_VALUE 10s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_VALUE 18s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_VALUE 10s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_VIAGRA m'(?!VIAGRA)(?:[vw]|\\/){1,3}[i1l\|]{1,3}(?:[a\@4åä]|/\\){1,3}[g69]{1,3}r+(?:[a\@4åä]|/\\){1,3}'i describe SARE_OBFU_VIAGRA found apparent obfuscation of word used in spam score SARE_OBFU_VIAGRA 1.666 #ham SARE_OBFU_VIAGRA verified (several) #counts SARE_OBFU_VIAGRA 3987s/2h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_VIAGRA 468s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_VIAGRA 210s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_VIAGRA 122s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_VIAGRA 140s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_VIAGRA 1s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_VIAGRA_POX m{(?!VIAGRA)V[-_`~!^&*()=+'";:?.,]?I[-_`~!^&*()=+'";:?.,]?A[-_`~!^&*()=+'";:?.,]?G[-_`~!^&*()=+'";:?.,]?R[-_`~!^&*()=+'";:?.,]?A}i describe SARE_OBFU_VIAGRA_POX found apparent obfuscation of word used in spam score SARE_OBFU_VIAGRA_POX 1.666 #counts SARE_OBFU_VIAGRA_POX 2169s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_VIAGRA_POX 96s/3h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_VIAGRA_POX 21s/0h of 45520 corpus (41534s/3986h MY) 05/16/05 #max SARE_OBFU_VIAGRA_POX 42s/0h of 46903 corpus (42982s/3921h MY) 05/09/05 #counts SARE_OBFU_VIAGRA_POX 24s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_VIAGRA_POX 32s/0h of 10829 corpus (6367s/4462h CT) 05/08/05 #counts SARE_OBFU_VIAGRA_POX 1s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_VIDEO_SUB Subject =~ /(?!vid[eé]o)\b(?:v.?i.?d.?e.?o|[vu][\W_]?[il1:\|\*\xCC-\xCF\xEC-\xEF][\W_]?[d\xD0][\W_]?[e3\*\xC8-\xCB\xE8-\xEB][\W_]?(?:\[\]|\(\)|[o0\*\xD2-\xD6\xF2-\xF6]))\b/i describe SARE_OBFU_VIDEO_SUB subject has obfuscated spammer topic #stype SARE_OBFU_VIDEO_SUB obfu score SARE_OBFU_VIDEO_SUB 2.500 #stype SARE_OBFU_VIDEO_SUB obfu #counts SARE_OBFU_VIDEO_SUB 5s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_VIDEO_SUB 10s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_OBFU_VIDEO_SUB 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_OBFU_VIDEO_SUB 2s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_VIDEO_SUB 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_OBFU_VIDEO_SUB 3s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_OBFU_VIDEO_SUB 1s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_OBFU_VIDEO_SUB 3s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_VIDEO_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 #body __SARE_OBFU_VISIT1 /(?!\bvisit\b)(?:\b([vu])(?:\1){0,2}|\B(\\\/|\xCE\xBD)(?:\2){0,2})[\W\d_]?([il1:\|\*ý-ýý-ýý]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)(?:\3){0,2}[\W\d_]?([s5\$ý]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)(?:\4){0,2}[\W\d_]?([il1:\|\*ý-ýý-ýý]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)(?:\5){0,2}[\W\d_]?(?:(t)(?:\6){0,2}\b|([\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)(?:\7){0,2}\B)/i #counts __SARE_OBFU_VISIT1 2874s/2h of 290849 corpus (122033s/168816h RM) 05/01/05 #counts __SARE_OBFU_VISIT1 157s/0h of 43978 corpus (40095s/3883h MY) 05/01/05 #counts __SARE_OBFU_VISIT1 92s/0h of 10828 corpus (6369s/4459h CT) 05/02/05 #body __SARE_OBFU_VISIT_NUM m'(?!visit)\bv\d?i\d?s\d?i\d?t\b'i #describe __SARE_OBFU_VISIT_NUM found apparent obfuscation of word used in spam #counts __SARE_OBFU_VISIT_NUM 783s/0h of 282751 corpus (111071s/171680h RM) 05/02/05 #counts __SARE_OBFU_VISIT_NUM 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts __SARE_OBFU_VISIT_NUM 30s/0h of 43978 corpus (40095s/3883h MY) 05/01/05 #counts __SARE_OBFU_VISIT_NUM 0s/0h of 10828 corpus (6369s/4459h CT) 05/02/05 #meta SARE_OBFU_VISIT1 __SARE_OBFU_VISIT1 && __SARE_OBFU_VISIT_NUM #describe SARE_OBFU_VISIT1 found apparent obfuscation of word used in spam #score SARE_OBFU_VISIT1 2.222 #counts SARE_OBFU_VISIT1 463s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_VISIT1 1044s/0h of 299858 corpus (141237s/158621h RM) 07/12/05 #counts SARE_OBFU_VISIT1 185s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_VISIT1 0s/0h of 10828 corpus (6369s/4459h CT) 05/02/05 #counts SARE_OBFU_VISIT1 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 #meta SARE_OBFU_VISIT2 __SARE_OBFU_VISIT1 && !__SARE_OBFU_VISIT_NUM #describe SARE_OBFU_VISIT2 found apparent obfuscation of word used in spam #score SARE_OBFU_VISIT2 1.666 #counts SARE_OBFU_VISIT2 3956s/6h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_VISIT2 234s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_VISIT2 11s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_VISIT2 92s/0h of 10828 corpus (6369s/4459h CT) 05/02/05 #counts SARE_OBFU_VISIT2 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_YNGR_SUB Subject =~ /(?!YOUNGN?ER)\b(?:y.?o.?u.?n.?g.?e.?r|(?:y|(?:[\xA5\xDD\xFD]|\xC5[\xB6-\xB8]|\xCE\x8E|\xCE\xA5|\xCE\xA8|\xCE\xAB|\xCE\xB3|\xD0\xA3|\xD1\x83|\xD1\x9E|\xD2[\xAE-\xB1]))[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[uv\*\xB5\xD9-\xDC\xF9-\xFC]|\xC5[\xA8-\xB3]|\xC6[\xAF-\xB0]|\xC7[\x93-\x9C]|\xCE\xB0|\xCE\xBC|\xCF\x8B|\xCF\x8D|\xD4\xB1|\xD5\x84|\xD5\x8D)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[g69]|\xC4[\x9C-\xA3]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:r\b|(?:[\xAE]|\xC5[\x94-\x99]|\xD1\x93)))\b/i describe SARE_OBFU_YNGR_SUB subject has obfuscated spammer topic score SARE_OBFU_YNGR_SUB 2.500 #stype SARE_OBFU_YNGR_SUB obfu #ham SARE_OBFU_YNGR_SUB Mar 2005: Added exclusion for proper name: Youngner #counts SARE_OBFU_YNGR_SUB 0s/0h of 196665 corpus (96196s/100469h RM) 02/21/05 #max SARE_OBFU_YNGR_SUB 4s/0h of 114221 corpus (81067s/33154h RM) 01/15/05 #counts SARE_OBFU_YNGR_SUB 1s/0h of 47845 corpus (43810s/4035h MY) 05/28/05 #max SARE_OBFU_YNGR_SUB 4s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_YNGR_SUB 0s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_OBFU_YNGR_SUB 12s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_OBFU_YNGR_SUB 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_YNGR_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 # EOF