# SARE Obfuscation Ruleset for SpamAssassin -- file 0 # Version: 01.00.11 # Created: 2005-05-02 # Modified: 2007-06-04 # Usage instructions and documentation in 70_sare_obfu0.cf # Full Revision History / Change Log in 70_sare_obfu.log #@@# 01.00.08: Oct 01 2005 #@@# Minor score updates based on additional mass-check #@@# Moved file 0 to file 1: SARE_OBFU_ALWAYS #@@# Moved file 0 to file 1: SARE_OBFU_CIALIS #@@# Moved file 0 to file 1: SARE_OBFU_CREDIT_POX #@@# Moved file 0 to file 1: SARE_OBFU_GOALS #@@# Moved file 0 to file 1: SARE_OBFU_ORDERING_SPL #@@# Moved file 0 to file 1: SARE_OBFU_RELIABLE #@@# Moved file 0 to file 1: SARE_OBFU_RESULTING #@@# Moved file 0 to file 1: SARE_OBFU_SOMA #@@# Moved file 0 to file 1: SARE_OBFU_STOCKS #@@# Moved file 0 to file x31: SARE_OBFU_AFFORD #@@# Moved file 2 to file 0: SARE_OBFU_PRESENTLY #@@# Removed rule for SA 3.2: SARE_OBFU_XANAX #@@# Removed rule for SA 3.2: SARE_OBFU_MEDS2 #@@# Removed rule for SA 3.2: SARE_OBFU_VICODIN # License: Artistic - see http://www.rulesemporium.com/license.txt # Current Maintainer: Doc Schneider - maddoc@maddoc.net # Past Maintainer: Bob Menschel - RMSA@Menschel.net # Current Home: http://www.rulesemporium.com/rules/70_sare_obfu0.cf # # Usage: This family of files, 70_sare_obfu*.cf, contain rules that test for common # types of obfuscation, and for commonly obfuscated words in subject headers and email bodies. # # Note: As of version 00.01.00, 2005-04-30, Only files obfu0.cf and obfu1.cf exist. # Testing of additional words is on-going, and we expect these files/rules to grow quickly. # # WARNING: As with many obfuscation rules and files, many of the rules in this family are # language-dependent, most specifically English-dependent, and in some areas, American-dependent. # Be very careful if applying any of these files on systems where large numbers of emails are non-English. # And if/when you find non-spam that hits these rules, please send copies to SARE so we can adjust our scores. # # WARNING # 2: Despite our best efforts at keeping the performance impact within reason, these rules files # WILL slow down your email processing. Systems that are tight on resources, or that have trouble keeping # up with the email flow, will want to think twice or thrice. # # File 0: 70_sare_obfu0.cf -- These are obfuscation rules that hit at least 10 spam and no ham. # While SARE cannot guarantee they never will hit ham, they have not hit ham in any SARE # mass-check, against tens of thousands of ham. This is a rules file we expect any/all # email systems using SpamAssassin to benefit from. # Note! Some of these rules WILL hit ham, if words in ham are misspelled in just the right way. # We cannot tell you that it won't happen -- all we can say is that WE haven't seen those # misspellings yet. Fortunately, we see from our experience that ham should not have more than # one such misspelling in any one email. Therefore even a rule score of 1.666 should not cause # any email to be flagged as spam unless it starts out as a very spammy ham. # # File 1: 70_sare_obfu1.cf -- These are obfuscation rules that meet one of the follow criteria: # a) Rules that do, or in the past have hit ham during SARE mass-check tests # b) Rules that hit no ham and currently do not hit more than 10 spam in any single mass-check run. # If the rules hit ham, they hit at last 10 spam to each 1 ham. # With few exceptions these rules score significantly less than the rules in file 0. # Systems which are very sensitive to false positives and/or need to be very careful about resource # use may want to exclude this ruleset, pick and choose among its rules, or lower their scores. # Systems that use this file 1 should ALSO use file 0. # # File 2: 70_sare_obfu2.cf -- These obfuscation rules hit no spam at this time, but they are considered # "safe" rules that should never hit ham. # These are primarily rules that test for specific words seen only in spam, or similar types of # "pretty darn sure" rules. # Systems which are very sensitive to SpamAssassin overhead may want to exclude this ruleset file to # avoid its overhead, but systems with plenty of resources that want to be aggressive against spam # may benefit from this ruleset file. # # File 3: 70_sare_obfu3.cf -- These are obfuscation rules that hit a significant amount of spam, but also # hit a significant amount of hm during SARE mass-check tests. # Systems which are very sensitive to false positives or to SA resource usage should NOT install this ruleset. # # File 4: 70_sare_obfu4.cf -- These are obfuscation rules that meet one of the following criteria: # a) They hit over 100 ham during SARE mass-check tests, but still hit enough spam to be worth while to aggressively anti-spam systems. # b) They hit no emails at this time, but have been recommended by anti-spam sources (such as rules developed from Spam-L list reports). # They seem riskier than the no-hit rules we put into file 2. # Again, systems which are very sensitive to false positives or to SA resource usage should NOT install this ruleset. # # eng: 70_sare_obfu_eng.cf -- These are obfuscation rules which work well within the English language, but are liable to cause false # positives in other languages. They include rules which test for letter combinations and encoded header headers. Systems that # receive ham in languages other than English should NOT use this file. # # arc: 70_sare_obfu_arc.cf -- These are obfuscation rules that once were published in other files, but which have since lost all value. # They either hit too much ham (without hitting enough spam to make it worth while), or they don't hit any spam. # SARE regularly runs mass-checks on these rules to see if any of them are worth reviving, but # we expect that nobody will be running these rules in any production system. ######## ###################### ################################################## # Rules renamed or moved ######## ###################### ################################################## meta SARE_OBFU_ALWAYS 0 meta SARE_OBFU_CIALIS 0 meta SARE_OBFU_CREDIT_POX 0 meta SARE_OBFU_GOALS 0 meta SARE_OBFU_ORDERING_SPL 0 meta SARE_OBFU_RELIABLE 0 meta SARE_OBFU_RESULTING 0 meta SARE_OBFU_SOMA 0 meta SARE_OBFU_STOCKS 0 meta SARE_OBFU_AFFORD 0 ######## ###################### ################################################## # Technical Obfuscations ######## ###################### ################################################## full SARE_OBFU_AMP2B m'(?:(?!http://)h.?t.?t.?p.?:.?/.?/)[^/\?]{4,40}\&'is describe SARE_OBFU_AMP2B invalid character within URI host/domain score SARE_OBFU_AMP2B 2.555 #hist SARE_OBFU_AMP2B Bob Menschel, June 4 2005 from idea posted by Alex Broens #counts SARE_OBFU_AMP2B 369s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_AMP2B 4945s/0h of 271461 corpus (129860s/141601h RM) 06/12/05 #counts SARE_OBFU_AMP2B 8s/0h of 5638 corpus (1019s/4619h ft) 06/04/05 #counts SARE_OBFU_AMP2B 3s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_AMP2B 0s/0h of 325 corpus (279s/46h CT) 06/04/05 full SARE_OBFU_CONTENT01 /Content-Type: ;text\/plain;/ describe SARE_OBFU_CONTENT01 Obfuscation via content-type header score SARE_OBFU_CONTENT01 2.500 #stype SARE_OBFU_CONTENT01 obfu #hist SARE_OBFU_CONTENT01 Frederic Tarasevicius, May 26, 2005 #counts SARE_OBFU_CONTENT01 19s/0h of 619677 corpus (318875s/300802h RM) 09/11/05 #max SARE_OBFU_CONTENT01 207s/0h of 275081 corpus (134226s/140855h RM) 05/30/05 #counts SARE_OBFU_CONTENT01 1s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_CONTENT01 85s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_OBFU_CONTENT01 0s/0h of 47845 corpus (43810s/4035h MY) 05/28/05 body SARE_OBFU_DRUGDOL1_SPC m{\$1\.\s+\$1\.\s+\$1\.\s+}i describe SARE_OBFU_DRUGDOL1_SPC found apparent obfuscation of word used in spam score SARE_OBFU_DRUGDOL1_SPC 2.333 #stype SARE_OBFU_DRUGDOL1_SPC spamp #counts SARE_OBFU_DRUGDOL1_SPC 261s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_DRUGDOL1_SPC 1s/0h of 10829 corpus (6367s/4462h CT) 05/08/05 #counts SARE_OBFU_DRUGDOL1_SPC 105s/0h of 45520 corpus (41534s/3986h MY) 05/16/05 #counts SARE_OBFU_DRUGDOL1_SPC 4s/0h of 4677 corpus (810s/3867h ft) 05/28/05 body SARE_OBFU_GPIL_TAG m{>G\s+P[-_`~!^&*()=+'";:?.,]?I[-_`~!^&*()=+'";:?.,]?L<}i describe SARE_OBFU_GPIL_TAG found apparent obfuscation of word used in spam score SARE_OBFU_GPIL_TAG 1.666 #stype SARE_OBFU_GPIL_TAG spamp #counts SARE_OBFU_GPIL_TAG 95s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_GPIL_TAG 983s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_GPIL_TAG 0s/0h of 10829 corpus (6367s/4462h CT) 05/08/05 #counts SARE_OBFU_GPIL_TAG 0s/0h of 46903 corpus (42982s/3921h MY) 05/09/05 #counts SARE_OBFU_GPIL_TAG 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 rawbody __SARE_OBFU_SPLIT_HR1A /href=\"[^"]*\r[^\n]/is full __SARE_OBFU_SPLIT_HR1B /href=\"[^"]*\r[^\n]/is meta SARE_OBFU_SPLIT_HR1 __SARE_OBFU_SPLIT_HR1A || __SARE_OBFU_SPLIT_HR1B score SARE_OBFU_SPLIT_HR1 2.500 #stype SARE_OBFU_SPLIT_HR1 obfu describe SARE_OBFU_SPLIT_HR1 unescaped cr in uri #hist SARE_OBFU_SPLIT_HR1 Loren Wilton #counts SARE_OBFU_SPLIT_HR1 13s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_SPLIT_HR1 49s/0h of 292007 corpus (122219s/169788h RM) 04/27/05 #counts SARE_OBFU_SPLIT_HR1 0s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_SPLIT_HR1 11s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_OBFU_SPLIT_HR1 781s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 ######## ###################### ################################################## # Numerical Obfuscations ######## ###################### ################################################## body SARE_OBFU_NUMS2 /\d,0OO/i describe SARE_OBFU_NUMS2 Obfuscation involving numbers score SARE_OBFU_NUMS2 1.666 #hist SARE_OBFU_NUMS2 Fred Tarasevicius, May 2005 #counts SARE_OBFU_NUMS2 183s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_NUMS2 12s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_NUMS2 2s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_NUMS2 11s/0h of 4650 corpus (807s/3843h ft) 05/27/05 body SARE_OBFU_NUMS3a /\doo[o0] d[o0][l|][l|]ars/i describe SARE_OBFU_NUMS3a Obfuscation involving numbers score SARE_OBFU_NUMS3a 0.967 #hist SARE_OBFU_NUMS3a Fred Tarasevicius, May 2005 #counts SARE_OBFU_NUMS3a 8s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_NUMS3a 53s/0h of 261031 corpus (115925s/145106h RM) 05/29/05 #counts SARE_OBFU_NUMS3a 10s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_NUMS3a 1s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_NUMS3a 10s/0h of 4650 corpus (807s/3843h ft) 05/27/05 body SARE_OBFU_NUMS3b /\do[o0][o0] d[o0][l|][l|]ars/i describe SARE_OBFU_NUMS3b Obfuscation involving numbers score SARE_OBFU_NUMS3b 1.278 #hist SARE_OBFU_NUMS3b Fred Tarasevicius, May 2005 #counts SARE_OBFU_NUMS3b 18s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_NUMS3b 103s/0h of 261031 corpus (115925s/145106h RM) 05/29/05 #counts SARE_OBFU_NUMS3b 13s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_NUMS3b 3s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_NUMS3b 17s/0h of 4650 corpus (807s/3843h ft) 05/27/05 body SARE_OBFU_NUMS3c /\d[o0][o0]o d[o0][l|][l|]ars/i describe SARE_OBFU_NUMS3c Obfuscation involving numbers score SARE_OBFU_NUMS3c 1.261 #hist SARE_OBFU_NUMS3c Fred Tarasevicius, May 2005 #counts SARE_OBFU_NUMS3c 13s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_NUMS3c 94s/0h of 258068 corpus (113628s/144440h RM) 05/27/05 #counts SARE_OBFU_NUMS3c 14s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_NUMS3c 5s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_NUMS3c 14s/0h of 4650 corpus (807s/3843h ft) 05/27/05 body SARE_OBFU_NUMS3d /\d[o0]o[o0] d[o0][l|][l|]ars/i describe SARE_OBFU_NUMS3d Obfuscation involving numbers score SARE_OBFU_NUMS3d 1.367 #hist SARE_OBFU_NUMS3d Fred Tarasevicius, May 2005 #counts SARE_OBFU_NUMS3d 16s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_NUMS3d 108s/0h of 258068 corpus (113628s/144440h RM) 05/27/05 #counts SARE_OBFU_NUMS3d 19s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_NUMS3d 4s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_NUMS3d 15s/0h of 4650 corpus (807s/3843h ft) 05/27/05 ######## ###################### ################################################## # Single Word Obfuscations (alphabetically) ######## ###################### ################################################## body SARE_OBFU_BACK_NUM m'(?!BACK)\bb\d?a\d?c\d?k\b'i describe SARE_OBFU_BACK_NUM found apparent obfuscation of word used in spam score SARE_OBFU_BACK_NUM 1.666 #counts SARE_OBFU_BACK_NUM 125s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_BACK_NUM 416s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_BACK_NUM 76s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_BACK_NUM 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_BACK_NUM 0s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_BACK_NUM 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_BUY_SUB Subject =~ /(?:^\s*bu\Wy |\bbvy\b)/i describe SARE_OBFU_BUY_SUB subject has obfuscated spammer topic score SARE_OBFU_BUY_SUB 3.333 #stype SARE_OBFU_BUY_SUB obfu #hist SARE_OBFU_BUY_SUB Created by Bob Menschel Aug 5 2004 #hist SARE_OBFU_BUY_SUB Two similar but different rules merged, May 27 2005 #counts SARE_OBFU_BUY_SUB 100s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_BUY_SUB 199s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_OBFU_BUY_SUB 6s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_OBFU_BUY_SUB 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_OBFU_BUY_SUB 8s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_BUY_SUB 2s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_BUY_SUB 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_BUY_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_CHEAP_SUB Subject =~ /(?!cheap(er)?)\b(?:c.?h.?e.?a.?p.?(?:e.?r)?|[c\xC7\xE7\xA2\xA9][\W_]?h[\W_]?[e3\*\xC8-\xCB\xE8-\xEB][\W_]?[a4\*\@\xC0-\xC5\xAA\xE0-\xE5][\W_]?p([e3\*\xC8-\xCB\xE8-\xEB][\W_]?[r\xAE])?)/i describe SARE_OBFU_CHEAP_SUB subject has obfuscated spammer topic score SARE_OBFU_CHEAP_SUB 3.333 #stype SARE_OBFU_CHEAP_SUB obfu #counts SARE_OBFU_CHEAP_SUB 49s/0h of 619677 corpus (318875s/300802h RM) 09/11/05 #max SARE_OBFU_CHEAP_SUB 338s/0h of 400345 corpus (178117s/222228h RM) 03/31/05 #counts SARE_OBFU_CHEAP_SUB 57s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_OBFU_CHEAP_SUB 21s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_CHEAP_SUB 55s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_CHEAP_SUB 4s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_CHEAP_SUB 22s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_CHEAP_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_CLICK_NUM m'(?!click)\bc\d?l\d?i\d?c\d?k(?:\d?(?:e\d?d|i\d?n\d?g|s))?\b'i describe SARE_OBFU_CLICK_NUM found apparent obfuscation of word used in spam score SARE_OBFU_CLICK_NUM 2.222 #hist SARE_OBFU_CLICK_NUM More generalized obfu click attempted May 1 2005, hit 1186s/6h #counts SARE_OBFU_CLICK_NUM 493s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_CLICK_NUM 1011s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_CLICK_NUM 207s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_CLICK_NUM 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_CLICK_NUM 0s/0h of 10828 corpus (6369s/4459h CT) 05/02/05 #counts SARE_OBFU_CLICK_NUM 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 #counts SARE_OBFU_CLICK_NUM 67s/0h of 45520 corpus (41534s/3986h MY) 05/16/05 body SARE_OBFU_CONFLICT m'(?!CONFLICT(?:s|ing)?)\bc+[o0]+[nñ]+f+[l\|]+[i1l\|]+c+t+(?:s+|[i1l\|]+[nñ]+[g69]+)?\b'i describe SARE_OBFU_CONFLICT found apparent obfuscation of word used in spam score SARE_OBFU_CONFLICT 1.666 #counts SARE_OBFU_CONFLICT 154s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_CONFLICT 307s/0h of 295111 corpus (124249s/170862h RM) 04/19/05 #counts SARE_OBFU_CONFLICT 145s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_CONFLICT 0s/0h of 41487 corpus (37599s/3888h MY) 04/18/05 #counts SARE_OBFU_CONFLICT 8s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_CONFLICT 93s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_CONFLICT 4s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_ESTABLISH_PX m{(?!ES-?T-?AB-?LISH(?:ES|ED|ING)?)E[-_`~!^&*()=+'";:?.,]?S[-_`~!^&*()=+'";:?.,]?T[-_`~!^&*()=+'";:?.,]?A[-_`~!^&*()=+'";:?.,]?B[-_`~!^&*()=+'";:?.,]?L[-_`~!^&*()=+'";:?.,]?I[-_`~!^&*()=+'";:?.,]?S[-_`~!^&*()=+'";:?.,]?H(?:[-_`~!^&*()=+'";:?.,]?(?:E[-_`~!^&*()=+'";:?.,]?[SD]|I[-_`~!^&*()=+'";:?.,]?N[-_`~!^&*()=+'";:?.,]?G))?\b}i describe SARE_OBFU_ESTABLISH_PX found apparent obfuscation of word used in spam score SARE_OBFU_ESTABLISH_PX 2.222 #hist SARE_OBFU_ESTABLISH_PX Bob Menschel, Apr 23 2005 #hist SARE_OBFU_ESTABLISH_PX Added exclusions for hyphenation, found in ham #counts SARE_OBFU_ESTABLISH_PX 16s/0h of 619677 corpus (318875s/300802h RM) 09/11/05 #max SARE_OBFU_ESTABLISH_PX 1291s/0h of 274568 corpus (109718s/164850h RM) 05/09/05 #counts SARE_OBFU_ESTABLISH_PX 0s/0h of 43978 corpus (40095s/3883h MY) 05/01/05 #counts SARE_OBFU_ESTABLISH_PX 3s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_ESTABLISH_PX 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_HERE_NUM m'(?!here)\bh\d?e\d?r\d?e\b'i describe SARE_OBFU_HERE_NUM found apparent obfuscation of word used in spam score SARE_OBFU_HERE_NUM 2.222 #counts SARE_OBFU_HERE_NUM 617s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_HERE_NUM 1429s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_HERE_NUM 283s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_HERE_NUM 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_HERE_NUM 2s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_HERE_NUM 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_HYDROCODONE m'(?!HYDROCODONE)h+y+d+r+[o0]+c+[o0]+d+[o0]+[nñ]+[e3]+'i describe SARE_OBFU_HYDROCODONE found apparent obfuscation of word used in spam score SARE_OBFU_HYDROCODONE 1.666 #counts SARE_OBFU_HYDROCODONE 1s/0h of 619677 corpus (318875s/300802h RM) 09/11/05 #max SARE_OBFU_HYDROCODONE 394s/0h of 293625 corpus (119414s/174211h RM) 04/14/05 #counts SARE_OBFU_HYDROCODONE 66s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_HYDROCODONE 0s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_HYDROCODONE 6s/0h of 41487 corpus (37599s/3888h MY) 04/18/05 #counts SARE_OBFU_HYDROCODONE 2s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_HYDROCODONE 26s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_HYDROCODONE 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_MATERIALLY m'(?!materiaa?l(?:ly)?)\b(?:m|rn)+(?:[a\@4åä]|/\\)+t+[e3]+r+[i1l\|]+(?:[a\@4åä]|/\\)+[l\|]+(?:[l\|]+y+)?\b'i describe SARE_OBFU_MATERIALLY found apparent obfuscation of word used in spam score SARE_OBFU_MATERIALLY 1.666 #hist SARE_OBFU_MATERIALLY Aug 2005: Allow materiaal as used in Norwegian email #counts SARE_OBFU_MATERIALLY 148s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_MATERIALLY 435s/0h of 295111 corpus (124249s/170862h RM) 04/19/05 #counts SARE_OBFU_MATERIALLY 241s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_MATERIALLY 0s/0h of 41487 corpus (37599s/3888h MY) 04/18/05 #counts SARE_OBFU_MATERIALLY 10s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_MATERIALLY 95s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_MATERIALLY 4s/0h of 2202 corpus (356s/1846h ft) 05/16/05 #body __SARE_OBFU_MEDS1 /(?!medications)\bm[eÈÉÊËèéêë3][dÐ][iÌÍÎÏìíîï\|1l\!][cÇ\(][aÀÁÂÃÄÅàáâãäå4\@][t+7][iÌÍÎÏìíîï\|1l\!][oÒÓÔÕÖòóôõöøðØ0][nÑñ][sz5\$]\b/i #body __SARE_OBFU_MEDS2 /(?!\bmedications?\b)(?:\b(m)(?:\1){0,2}|\B(rn|\/V\\|\/\\\/\\|\xCE\x9C|\xD0\x9C|\xD0\xBC)(?:\2){0,2})[\W\d_]?([e3\*ý-ýý-ý]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)(?:\3){0,2}[\W\d_]?([dý]|\xC4[\x8E-\x91])(?:\4){0,2}[\W\d_]?([il1:\|\*ý-ýý-ýý]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)(?:\5){0,2}[\W\d_]?([c\*ýýýý]|\xC4[\x86-\x8D]|\xD0\xA1|\xD1\x81)(?:\6){0,2}[\W\d_]?([a4\*\@ý-ýýý-ý]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)(?:\7){0,2}[\W\d_]?([t\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)(?:\8){0,2}[\W\d_]?([il1:\|\*ý-ýý-ýý]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)(?:\9){0,2}[\W\d_]?([o0\*ýýýýý-ýý-ý]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)(?:\10){0,2}[\W\d_]?([nýý]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)(?:\11){0,2}[\W\d_]?(?:([s5\$ý]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)(?:\12){0,2})?\b/i #body __SARE_OBFU_MEDS3 /\bmediz\b/ #meta SARE_OBFU_MEDS __SARE_OBFU_MEDS1 || __SARE_OBFU_MEDS2 || __SARE_OBFU_MEDS3 #describe SARE_OBFU_MEDS found apparent obfuscation of word used in spam #score SARE_OBFU_MEDS 2.777 #hist SARE_OBFU_MEDS __SARE_OBFU_MEDS1 originally J_3L33T_MEDCTN by Jennifer Wheeler #hist SARE_OBFU_MEDS __SARE_OBFU_MEDS2 by Bob Menschel, Apr 2005 #hist SARE_OBFU_MEDS __SARE_OBFU_MEDS3 by Bob Menschel, Aug 2005 #overlap SARE_OBFU_MEDS Replaces (does better than) Jennifer Wheeler's J_3L33T_MEDCTN and Bob's RM_bwm_medication #counts SARE_OBFU_MEDS 6094s/2h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_MEDS 473s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_MEDS 58s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_MEDS 41s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_MEDS 161s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_MEDS 3s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 #body SARE_OBFU_MEDS2_NUM m'(?!MEDS)\bM\d?E\d?D\d?S\b'i #describe SARE_OBFU_MEDS2_NUM found apparent obfuscation of word used in spam #score SARE_OBFU_MEDS2_NUM 1.666 #counts SARE_OBFU_MEDS2_NUM 140s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_MEDS2_NUM 351s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_MEDS2_NUM 59s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_MEDS2_NUM 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_MEDS2_NUM 0s/0h of 10828 corpus (6369s/4459h CT) 05/02/05 #counts SARE_OBFU_MEDS2_NUM 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_MORTGAGE_POX m{(?!mortgage)\bm[-_`~!^&*()=+'";:?.,]?o[-_`~!^&*()=+'";:?.,]?r[-_`~!^&*()=+'";:?.,]?t[-_`~!^&*()=+'";:?.,]?g[-_`~!^&*()=+'";:?.,]?a[-_`~!^&*()=+'";:?.,]?g[-_`~!^&*()=+'";:?.,]?e}i describe SARE_OBFU_MORTGAGE_POX found apparent obfuscation of word used in spam score SARE_OBFU_MORTGAGE_POX 1.666 #counts SARE_OBFU_MORTGAGE_POX 413s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_MORTGAGE_POX 659s/0h of 274568 corpus (109718s/164850h RM) 05/09/05 #counts SARE_OBFU_MORTGAGE_POX 28s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_MORTGAGE_POX 34s/0h of 47845 corpus (43810s/4035h MY) 05/28/05 #counts SARE_OBFU_MORTGAGE_POX 26s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_MORTGAGE_POX 13s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_MORTGAGE_POX 4s/0h of 7500 corpus (1767s/5733h ft) 09/18/05 header SARE_OBFU_MORTGAGE_SUB Subject =~ /(?!mortgages?)\b(?:m.o.r.t.g.a.g.e|(?:m|(?:rn|\/V\\|\/\\\/\\|\xCE\x9C|\xD0\x9C|\xD0\xBC))[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[g69]|\xC4[\x9C-\xA3]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[g69]|\xC4[\x9C-\xA3]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3]\b|(?:[\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)))s?\b/i describe SARE_OBFU_MORTGAGE_SUB subject has obfuscated spammer topic score SARE_OBFU_MORTGAGE_SUB 3.333 #stype SARE_OBFU_MORTGAGE_SUB obfu #counts SARE_OBFU_MORTGAGE_SUB 87s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_MORTGAGE_SUB 367s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_OBFU_MORTGAGE_SUB 20s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_OBFU_MORTGAGE_SUB 9s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_MORTGAGE_SUB 37s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_MORTGAGE_SUB 35s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_MORTGAGE_SUB 38s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_MORTGAGE_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_ONLINE_SUB Subject =~ /(?!\bON[- ]?LINE\b)\b(?:o.?n.?l.?i.?n.?e|(?:[o0]|(?:[\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95))[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[l1I\|\xA3]|(?:\xC5[\x80-\x82]|\xC4[\xB9-\xBF]))[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3]\b|(?:[\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)))\b/i describe SARE_OBFU_ONLINE_SUB subject has obfuscated spammer topic score SARE_OBFU_ONLINE_SUB 3.333 #stype SARE_OBFU_ONLINE_SUB obfu #hist SARE_OBFU_ONLINE_SUB Added exclusions; eliminated ham hits #counts SARE_OBFU_ONLINE_SUB 119s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_ONLINE_SUB 345s/0h of 115435 corpus (94246s/21189h) 04/25/04 #counts SARE_OBFU_ONLINE_SUB 34s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #max SARE_OBFU_ONLINE_SUB 59s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_OBFU_ONLINE_SUB 10s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_ONLINE_SUB 65s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_ONLINE_SUB 10s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_ONLINE_SUB 52s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_ONLINE_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_ONLY_TAG m{>L[-_`~!^&*()=+'";:?.,]?Y\ \$[1-9]}i describe SARE_OBFU_ONLY_TAG found apparent obfuscation of word used in spam score SARE_OBFU_ONLY_TAG 1.666 #counts SARE_OBFU_ONLY_TAG 95s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_ONLY_TAG 991s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_ONLY_TAG 0s/0h of 10829 corpus (6367s/4462h CT) 05/08/05 #counts SARE_OBFU_ONLY_TAG 0s/0h of 46903 corpus (42982s/3921h MY) 05/09/05 #counts SARE_OBFU_ONLY_TAG 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_ORIGSOFT_SUB Subject =~ /(?!original software)(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)?[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)?[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[g69]|\xC4[\x9C-\xA3]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[il1:\|\*\xCC-\xCF\xEC-\xEF\xA6]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)?[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[n\xD1\xF1]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)?[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[l1I\|\xA3]|(?:\xC5[\x80-\x82]|\xC4[\xB9-\xBF])) (?:[s5\$\xA7]|\xC5[\x9A-\xA1]|\xD0\x85|\xD1\x95|\xD5\x8F)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[o0\*\xB0\xBA\xD8\xF8\xD2-\xD6\xF2-\xF6]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)?[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:f|\xC5\xBF|\xC6\x92|\xD2[\x92-\x93]])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|\xC5[\xA2-\xA7]|\xCE\xA4|\xCF\x84|\xD0\xA2|\xD1\x82)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:w|\\\/\\\/|VV|\xC5[\xB4-\xB5]|\xCF[\x88-\x89]|\xCF\x8E])[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)?[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[r\xAE]|\xC5[\x94-\x99]|\xD1\x93)[\x01-\x2F\\\^_`\|\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[e3\*\xC8-\xCB\xE8-\xEB]|\xC4[\x92-\x9B]|\xCE\x88|\xCE\x95|\xCE\xA3|\xCE\xAD|\xCE\xB5|\xD0\x81|\xD0\x95|\xD0\xB5|\xD1\x91)?/i describe SARE_OBFU_ORIGSOFT_SUB found apparent obfuscation of word used in spam score SARE_OBFU_ORIGSOFT_SUB 2.500 #stype SARE_OBFU_ORIGSOFT_SUB obfu #hist SARE_OBFU_ORIGSOFT_SUB Created by Bob Menschel Jul 31 2004 #counts SARE_OBFU_ORIGSOFT_SUB 0s/0h of 196667 corpus (96194s/100473h RM) 02/21/05 #max SARE_OBFU_ORIGSOFT_SUB 92s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_OBFU_ORIGSOFT_SUB 20s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_OBFU_ORIGSOFT_SUB 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_OBFU_ORIGSOFT_SUB 9s/0h of 17008 corpus (14576s/2432h MY) 08/04/04 #counts SARE_OBFU_ORIGSOFT_SUB 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_ORIGSOFT_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header SARE_OBFU_PENIS_SUB Subject =~ /(?!penis)(?!pencils)(?!pennies)(?!Penn is)(?!Prentiss)\b(?:p.?e.?n.?i.?s|p[\W_]?[e3\*\xC8-\xCB\xE8-\xEB][\W_]?[n\xD1\xF1][\W_]?[il1:\|\*\xCC-\xCF\xEC-\xEF][\W_]?[s5\$\xA7])\b/i describe SARE_OBFU_PENIS_SUB subject has obfuscated spammer topic score SARE_OBFU_PENIS_SUB 3.333 #stype SARE_OBFU_PENIS_SUB obfu #hist SARE_OBFU_PENIS_SUB Added exclusion for "pennies" Jan 23 2004 #hist SARE_OBFU_PENIS_SUB Added other exclusions, May 2005 #counts SARE_OBFU_PENIS_SUB 108s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PENIS_SUB 541s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_OBFU_PENIS_SUB 64s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_OBFU_PENIS_SUB 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_OBFU_PENIS_SUB 41s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_OBFU_PENIS_SUB 9s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PENIS_SUB 14s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_OBFU_PENIS_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_PHARMACEUT m'(?!pharmaceutical)p+h+(?:[a\@4åä]|/\\)+r+(?:m|rn)+(?:[a\@4åä]|/\\)+c+[e3]+u+t+[i1l\|]+c+(?:[a\@4åä]|/\\)+[l\|]+'i describe SARE_OBFU_PHARMACEUT found apparent obfuscation of word used in spam score SARE_OBFU_PHARMACEUT 1.666 #counts SARE_OBFU_PHARMACEUT 115s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PHARMACEUT 371s/0h of 295111 corpus (124249s/170862h RM) 04/19/05 #counts SARE_OBFU_PHARMACEUT 24s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_PHARMACEUT 8s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_PHARMACEUT 1s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_PHARMACEUT 9s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_PHARM_ONL m{[o0][-_`~!^&*()=+'";:?.,]?[nñ][-_`~!^&*()=+'";:?.,]?[l\|][-_`~!^&*()=+'";:?.,]?[i1l\|][-_`~!^&*()=+'";:?.,]?[nñ][-_`~!^&*()=+'";:?.,]?[e3][-_`~!^&*()=+'";:?.,]?r[-_`~!^&*()=+'";:?.,]?x}i describe SARE_OBFU_PHARM_ONL found apparent obfuscation of word used in spam score SARE_OBFU_PHARM_ONL 2.222 #hist SARE_OBFU_PHARM_ONL Bob Menschel, Apr 23 2005 #counts SARE_OBFU_PHARM_ONL 435s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PHARM_ONL 1560s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_PHARM_ONL 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PHARM_ONL 6s/0h of 10829 corpus (6367s/4462h CT) 05/08/05 #counts SARE_OBFU_PHARM_ONL 217s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_PHARM_ONL 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 header __SARE_OK_PHARM Subject =~ /pharmacy/i header __SARE_OBFU_PHARM_SUB Subject =~ /p[p.]?h[h.]?a[a.]?r[ar.]?m[m.]?a[ac.]?c[c.]?[y.]?y/i meta SARE_OBFU_PHARM_SUB ( __SARE_OBFU_PHARM_SUB && !__SARE_OK_PHARM ) describe SARE_OBFU_PHARM_SUB Pharmacy for zombies score SARE_OBFU_PHARM_SUB 2.222 #hist SARE_OBFU_PHARM_SUB Robert Brooks, Mar 23 2005 #counts SARE_OBFU_PHARM_SUB 51s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PHARM_SUB 1177s/0h of 400644 corpus (178197s/222447h RM) 04/02/05 #counts SARE_OBFU_PHARM_SUB 20s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_PHARM_SUB 53s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #counts SARE_OBFU_PHARM_SUB 5s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PHARM_SUB 6s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_OBFU_PHARM_SUB 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_PILL_NUM m'(?!pills?)\bp\d?i\d?l\d?l(?:\d?s)?\b'i describe SARE_OBFU_PILL_NUM found apparent obfuscation of word used in spam score SARE_OBFU_PILL_NUM 1.666 #counts SARE_OBFU_PILL_NUM 147s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PILL_NUM 335s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_PILL_NUM 75s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_PILL_NUM 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_PILL_NUM 0s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_PILL_NUM 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_PRESENTLY m'(?!present(?:ly)?)\bp+r+[e3]+s+[e3]+[nñ]+t+(?:[l\|]+y+)?\b'i describe SARE_OBFU_PRESENTLY found apparent obfuscation of word used in spam score SARE_OBFU_PRESENTLY 0.555 #stype SARE_OBFU_PRESENTLY spamp #counts SARE_OBFU_PRESENTLY 21s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_PRESENTLY 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_PRESENTLY 0s/0h of 41487 corpus (37599s/3888h MY) 04/18/05 #counts SARE_OBFU_PRESENTLY 0s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_PRESENTLY 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_PROFILE m'(?!PROFILE?(?:s+|[i1l\|]+[nñ]+[g69]+|[e3]+d+)?)\bp+r+[o0]+f+[i1l\|]+[l\|]+e*(?:s+|[i1l\|]+[nñ]+[g69]+|[e3]+d+)?\b'i describe SARE_OBFU_PROFILE found apparent obfuscation of word used in spam score SARE_OBFU_PROFILE 1.666 #counts SARE_OBFU_PROFILE 84s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PROFILE 451s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_PROFILE 92s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_PROFILE 13s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_PROFILE 16s/0h of 47845 corpus (43810s/4035h MY) 05/28/05 #counts SARE_OBFU_PROFILE 12s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PROFILE 16s/0h of 10829 corpus (6367s/4462h CT) 05/08/05 #counts SARE_OBFU_PROFILE 20s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_PUBLISHER m'(?!PUBLISHERs?)\bp+u+b+[l\|]+[i1l\|]+s+h+[e3]+r+s*\b'i describe SARE_OBFU_PUBLISHER found apparent obfuscation of word used in spam score SARE_OBFU_PUBLISHER 1.666 #counts SARE_OBFU_PUBLISHER 80s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_PUBLISHER 459s/0h of 293625 corpus (119414s/174211h RM) 04/14/05 #counts SARE_OBFU_PUBLISHER 262s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_PUBLISHER 0s/0h of 41487 corpus (37599s/3888h MY) 04/18/05 #counts SARE_OBFU_PUBLISHER 6s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_PUBLISHER 99s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_PUBLISHER 4s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_SAVE_NUM m'(?!save)\bs\d?a\d?v\d?e\b'i describe SARE_OBFU_SAVE_NUM found apparent obfuscation of word used in spam score SARE_OBFU_SAVE_NUM 1.666 #counts SARE_OBFU_SAVE_NUM 287s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_SAVE_NUM 800s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_SAVE_NUM 2s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_SAVE_NUM 129s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_SAVE_NUM 0s/0h of 10828 corpus (6369s/4459h CT) 05/02/05 #counts SARE_OBFU_SAVE_NUM 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_SAVINGS_NUM m'(?!savings)\bs\d?a\d?v\d?i\d?n\d?g\d?s\b'i describe SARE_OBFU_SAVINGS_NUM found apparent obfuscation of word used in spam score SARE_OBFU_SAVINGS_NUM 1.666 #counts SARE_OBFU_SAVINGS_NUM 140s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_SAVINGS_NUM 316s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_SAVINGS_NUM 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_SAVINGS_NUM 59s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_SAVINGS_NUM 0s/0h of 10828 corpus (6369s/4459h CT) 05/02/05 #counts SARE_OBFU_SAVINGS_NUM 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_SPECIAL_TAG m{>(?:S[-_`~!^&*()=+'";:?.,]?P[-_`~!^&*()=+'";:?.,]?E[-_`~!^&*()=+'";:?.,]?C?I?|C?I[-_`~!^&*()=+'";:?.,]?A[-_`~!^&*()=+'";:?.,]?L|\ spe)<}i describe SARE_OBFU_SPECIAL_TAG found apparent obfuscation of word used in spam score SARE_OBFU_SPECIAL_TAG 1.666 #counts SARE_OBFU_SPECIAL_TAG 104s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_SPECIAL_TAG 991s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_SPECIAL_TAG 0s/0h of 10829 corpus (6367s/4462h CT) 05/08/05 #counts SARE_OBFU_SPECIAL_TAG 0s/0h of 46903 corpus (42982s/3921h MY) 05/09/05 #counts SARE_OBFU_SPECIAL_TAG 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_UP_NUM m'(?! UP ) U\d?P 'i describe SARE_OBFU_UP_NUM found apparent obfuscation of word used in spam score SARE_OBFU_UP_NUM 1.666 #counts SARE_OBFU_UP_NUM 140s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_UP_NUM 351s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_UP_NUM 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_UP_NUM 59s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_UP_NUM 0s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_UP_NUM 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 #body SARE_OBFU_VICODIN /(?!\bVICODIN\b)(?:\b([vu])(?:\1){0,2}|\B(\\\/|\xCE\xBD)(?:\2){0,2})[\W\d_]?([il1:\|\*ý-ýý-ýý]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)(?:\3){0,2}[\W\d_]?([c\*ýýýý]|\xC4[\x86-\x8D]|\xD0\xA1|\xD1\x81)(?:\4){0,2}[\W\d_]?([o0\*ýýýýý-ýý-ý]|\(\)|\[\]|\xC5[\x8C-\x91]|\xC6[\xA0-\xA1]|\xC7[\x91-\x92]|\xC7[\xBE-\xBF]|\xCE\x8C|\xCE\x98|\xCE\x9F|\xCE\xB8|\xCE\xBF|\xCF\x8C|\xD0\x9E|\xD0\xBE|\xD5\x95)(?:\5){0,2}[\W\d_]?([dý]|\xC4[\x8E-\x91])(?:\6){0,2}[\W\d_]?([il1:\|\*ý-ýý-ýý]|\xC4[\xA8-\xB0]|\xC4\xBA|\xC4\xBC|\xC4\xBE|\xC5\x80|\xC5\x82|\xC7[\x8F-\x90]|\xD0[\x86-\x87]|\xD1[\x96-\x97]|\xCE\x8A|\xCE\x90|\xCE\x99|\xCE\xAA|\xCE\xAF|\xCE\xB9|\xCF\x8A)(?:\7){0,2}[\W\d_]?(?:(n)(?:\8){0,2}\b|([ýý]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)(?:\9){0,2}\B)/i #describe SARE_OBFU_VICODIN found apparent obfuscation of word used in spam #score SARE_OBFU_VICODIN 2.222 #counts SARE_OBFU_VICODIN 25s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_VICODIN 1368s/0h of 290849 corpus (122033s/168816h RM) 05/01/05 #counts SARE_OBFU_VICODIN 260s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_VICODIN 44s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_VICODIN 106s/0h of 46903 corpus (42982s/3921h MY) 05/09/05 #counts SARE_OBFU_VICODIN 58s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_VICODIN 264s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_VICODIN 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_VOLUME m'(?!VOLUMEs?)\b(?:[vw]|\\/)+[o0]+[l\|]+u+(?:m|rn)+[e3]+s*\b'i describe SARE_OBFU_VOLUME found apparent obfuscation of word used in spam score SARE_OBFU_VOLUME 1.666 #counts SARE_OBFU_VOLUME 564s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_OBFU_VOLUME 80s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_VOLUME 3s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_VOLUME 13s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #counts SARE_OBFU_VOLUME 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_WILL m'(?!WILL(?:s?|ing|ed)?)\bwi[l\|]{2,}(?:s+|[i1l\|]+[nñ]+[g69]+|[e3]+d+)?\b'i describe SARE_OBFU_WILL found apparent obfuscation of word used in spam score SARE_OBFU_WILL 2.222 #counts SARE_OBFU_WILL 87s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_WILL 627s/0h of 274568 corpus (109718s/164850h RM) 05/09/05 #counts SARE_OBFU_WILL 280s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_WILL 3s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_WILL 18s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_WILL 112s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_WILL 20s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_WRONGFULLY m'(?!wrongful(?:ly)?)\bw+r+[o0]+[nñ]+[g69]+f+u+[l\|]+(?:[l\|]+y+)?\b'i describe SARE_OBFU_WRONGFULLY found apparent obfuscation of word used in spam score SARE_OBFU_WRONGFULLY 1.666 #counts SARE_OBFU_WRONGFULLY 52s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_WRONGFULLY 499s/0h of 274568 corpus (109718s/164850h RM) 05/09/05 #counts SARE_OBFU_WRONGFULLY 175s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_WRONGFULLY 0s/0h of 41487 corpus (37599s/3888h MY) 04/18/05 #counts SARE_OBFU_WRONGFULLY 8s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_WRONGFULLY 66s/0h of 10862 corpus (6387s/4475h CT) 05/28/05 #counts SARE_OBFU_WRONGFULLY 13s/0h of 2202 corpus (356s/1846h ft) 05/16/05 #body SARE_OBFU_XANAX /(?!\bXANAX\b)(?:\b(x)(?:\1){0,2}|\B([ý]|\>\<|\}\{|\xCE\xA7|\xCF\x87|\xD0\xA5|\xD1\x85|\xD2[\xB2-\xB3])(?:\2){0,2})[\W\d_]?([a4\*\@ý-ýýý-ý]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)(?:\3){0,2}[\W\d_]?([nýý]|\|\\\||\xC5[\x83-\x8B]|\xCE\x9D|\xCE\xA0|\xCE\xAE|\xCE\xB7|\xD5\xB2|\xD5\xB8)(?:\4){0,2}[\W\d_]?([a4\*\@ý-ýýý-ý]|\/\\|\xC4[\x80-\x85]|\xC7[\x8D-\x8E]|\xC7[\xBA-\xBB]|\xCE\x86|\xCE\x91|\xCE\x94|\xCE\x9B|\xCE\xAC|\xCE\xB1|\xD0\x90|\xD0\xB0)(?:\5){0,2}[\W\d_]?(?:(x)(?:\6){0,2}\b|([ý]|\>\<|\}\{|\xCE\xA7|\xCF\x87|\xD0\xA5|\xD1\x85|\xD2[\xB2-\xB3])(?:\7){0,2}\B)/i #describe SARE_OBFU_XANAX found apparent obfuscation of word used in spam #score SARE_OBFU_XANAX 2.222 #hist SARE_OBFU_XANAX Bob Menschel, April 2005 #overlap SARE_OBFU_XANAX Replaces MANGLED_XANAX by Jennifer Wheeler (hits 9% more spam) #counts SARE_OBFU_XANAX 208s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_XANAX 1529s/0h of 290849 corpus (122033s/168816h RM) 05/01/05 #counts SARE_OBFU_XANAX 141s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_XANAX 73s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #max SARE_OBFU_XANAX 80s/0h of 43978 corpus (40095s/3883h MY) 05/01/05 #counts SARE_OBFU_XANAX 83s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_OBFU_XANAX 170s/0h of 10829 corpus (6367s/4462h CT) 05/08/05 #counts SARE_OBFU_XANAX 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 body SARE_OBFU_NUM_YOUR m'(?!YOUR)\bY\d?O\d?U\d?R\b'i describe SARE_OBFU_NUM_YOUR found apparent obfuscation of word used in spam score SARE_OBFU_NUM_YOUR 1.666 #counts SARE_OBFU_NUM_YOUR 140s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_OBFU_NUM_YOUR 343s/0h of 263078 corpus (112438s/150640h RM) 05/16/05 #counts SARE_OBFU_NUM_YOUR 0s/0h of 29176 corpus (18189s/10987h DMS) 04/18/05 #counts SARE_OBFU_NUM_YOUR 59s/0h of 57287 corpus (52272s/5015h MY) 09/22/05 #counts SARE_OBFU_NUM_YOUR 0s/0h of 10870 corpus (6385s/4485h CT) 05/15/05 #counts SARE_OBFU_NUM_YOUR 0s/0h of 2202 corpus (356s/1846h ft) 05/16/05 # EOF