On Fri, 29 Jun 2018 10:20:45 -0400 Alex wrote: > On Thu, Jun 28, 2018 at 3:59 PM, Zinski, Steve <szin...@richmond.edu> > wrote:
> > These sextortion scammers are clever. So, instead of filtering on
> > the word “bitcoin”, I now filter on a bitcoin regex (see below)
> >
> >
> >
> > body __BITCOIN /\b[13][a-km-zA-HJ-NP-Z1-9]{25,34}\b/
> >
>
> This rule is creating false positives:
try:
body __BITCOIN /\b(?<!=)[13][a-km-zA-HJ-NP-Z1-9]{25,34}\b/
