Looks like the pilz spammers have finally ditched the letters+numbers format.
I'm now using this rule:
body __MED_OB
/\bw{2,3}(?:[[:punct:][:space:]]{1,5}|[[:space:][:punct:]]{1,3}dot[[:space:][:punct:]]{1,3})[[:alnum:]]{2,10}(?:[[:punct:][:space:]]{1,5}|[[:space:][:punct:]]{1,3}dot[[:space:][:punct:]]{1,3})(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g)[[:punct:]]?\b/i
body __MED_NOT_OB /\bw{2,3}\.[[:alnum:]]{2,10}\.(?:com|net|org)\b/i
meta AE_MED47 (__MED_OB && ! __MED_NOT_OB)
describe AE_MED47 Shorter rule to catch spam obfuscation
score AE_MED47 4.0
