Just a follow up, the expression I provided found the following matches (from my today logs)
Me - ga - Di k M eg ad ik M E _G_A_D_ IK Meg, a dik M_E GA D IK MegaDik Megadlk Mega Dik Mega_ Dik From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Olden Sent: Tuesday, August 21, 2007 3:39 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] ED Spam My bad. When I pasted the expression into a tester I have, it failed because of the line wrap after the "d". Putting it all on one line works. Duh. Thanks again, John Olden David Barker wrote: This does match M eg ad ik as you have described below -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Olden Sent: Tuesday, August 21, 2007 2:34 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] ED Spam Better but it didn't take long for me to get another that won't pass this test: M eg ad ik John Olden David Barker wrote: Try this ... (?i:\b(?!dick?)(m(\W?|_){0,3}e(\W?|_){0,3}g(\W?|_){0,[EMAIL PROTECTED])?(\W?|_){0,3}d(\ W?|_){0,3}[|li1í!](\W?|_){0,3}[ck]{1,2}\b) Will match on obfuscated dick (ie. D!ck) but NOT dick, can include mega obfuscated. David -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Olden Sent: Tuesday, August 21, 2007 1:40 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] ED Spam I'm still a little green on the regular expressions. I added the following to my filters and it has been doing good. BODY 100 PCRE m[\s_\.-]?(=2e)?e[\s_.-]?(=2e)?g[\s_.-]?(=2e)?a[\s_.-]?(=2e)?d[\s_.-]?(=2e)? i[\s_.-]?(=2e)?k but it doesn't catch Me - ga - Di k Any suggestions on a better expression? TIA -- John Olden - Technology Manager Champaign Park District --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. [(-265) D392a05a8000013b9.smd] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
