On Tue, 3 Dec 2019 14:05:10 -0500
Mark London wrote:
> It seems to me that the rule for detecting a BITCOIN in an email, is
> incorrect. See below:
>
> body __BITCOIN_ID /\b(?<!=)[13](?:\s?[a-km-zA-HJ-NP-Z1-9]){25,34}\b/
>
> Why is there a \s in this rule? I didn't think that a BITCOIN id
> has a space.It doesn't, but spammers have started splitting them up to evade detections.
