Re: False positives due to __BITCOIN_ID

2019-12-04 Thread Giovanni Bechis
On Wed, Dec 04, 2019 at 08:59:42AM +0100, Benny Pedersen wrote: > On 2019-12-03 20:15, RW wrote: > > On Tue, 3 Dec 2019 14:05:10 -0500 > > Mark London wrote: > > > >> It seems to me that the rule for detecting a BITCOIN in an email, is > >> incorrect. See below: > >> > >> body __BITCOIN_ID /\b(

Re: False positives due to __BITCOIN_ID

2019-12-04 Thread Benny Pedersen
On 2019-12-03 20:15, RW wrote: On Tue, 3 Dec 2019 14:05:10 -0500 Mark London wrote: It seems to me that the rule for detecting a BITCOIN in an email, is incorrect. See below: body __BITCOIN_ID /\b(? It doesn't, but spammers have started splitting them up to evade detections. if clients be

Re: False positives due to __BITCOIN_ID

2019-12-03 Thread RW
On Tue, 3 Dec 2019 11:27:11 -0800 (PST) John Hardin wrote: > On Tue, 3 Dec 2019, Mark London wrote: > > > It seems to me that the rule for detecting a BITCOIN in an email, > > is incorrect. See below: > > > > body __BITCOIN_ID /\b(? > > > Why is there a \s in this rule?I didn't think that a

Re: False positives due to __BITCOIN_ID

2019-12-03 Thread John Hardin
On Tue, 3 Dec 2019, Mark London wrote: It seems to me that the rule for detecting a BITCOIN in an email, is incorrect. See below: body __BITCOIN_ID /\b(?Why is there a \s in this rule?I didn't think that a BITCOIN id has a space. Recent obfuscation seen in RL extortion spams. This ru

Re: False positives due to __BITCOIN_ID

2019-12-03 Thread RW
On Tue, 3 Dec 2019 14:05:10 -0500 Mark London wrote: > It seems to me that the rule for detecting a BITCOIN in an email, is > incorrect. See below: > > body __BITCOIN_ID /\b(? > Why is there a \s in this rule?I didn't think that a BITCOIN id > has a space. It doesn't, but spammers have s