>Coming home for some minutes I saw, I am hit by 23.000 spams in my inbox
>from today...
>
>The rule:
>
>body AE_MEDS35
>/\bwww(?:\s\W?\s?|\W\s)\w{3,6}\d{2,6}(?:\s\W?\s?|\W\s)(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g)\b/i
>describe AE_MEDS35 obfuscated domain seen in spam
>score AE_MEDS35 6.00
>does not work on the following mail:
How about:
/\bw{2,3}[[:punct:][:space:]]{1,3}[[:alpha:]]{3,6}\d{2,6}[[:punct:][:space:]]{1,3}(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g)\b/i
