> While generic tests for character/letter obfuscation are 
> difficult, this
> guy is pretty predictable.
> 
>  body     SRH_PENNY2 /(?:e\s*mai\||mi[|l]{2}ions|resu\|ts|wi[|l]{2})/
> 
> Add your own l->| words to this list, although he hasn't failed to use
> one in the list above in each one of his spams.
> 
> -steve
> 

Replying to myself (ps. drink more coffee).  That should read:

body     SRH_PENNY2
/(?:e\s*mai\||mi\|lions|mil\|ions|resu\|ts|wil\|wi\|l)/i

Reply via email to