It seems to me that the rule for detecting a BITCOIN in an email, is incorrect. See below:

body __BITCOIN_ID /\b(?<!=)[13](?:\s?[a-km-zA-HJ-NP-Z1-9]){25,34}\b/

Why is there a \s in this rule? I didn't think that a BITCOIN id has a space.

This rule is triggered, on a simple line like this, because of the fact that the line has a "1" in it:

    For sure figure 1 is convincing that nqR is a good organising

Maybe this rule needs tweaking?   Thanks.

- Mark


Reply via email to