> While generic tests for character/letter obfuscation are > difficult, this > guy is pretty predictable. > > body SRH_PENNY2 /(?:e\s*mai\||mi[|l]{2}ions|resu\|ts|wi[|l]{2})/ > > Add your own l->| words to this list, although he hasn't failed to use > one in the list above in each one of his spams. > > -steve >
Replying to myself (ps. drink more coffee). That should read: body SRH_PENNY2 /(?:e\s*mai\||mi\|lions|mil\|ions|resu\|ts|wil\|wi\|l)/i