Adam Lyon


Spam Catching Regular Expressions (regex)

Return to Free Spam Filtering Tactics Using Eudora

Permutations of Letters

[a\@]
[b8]
[c6]
[db]
[e3]
f
[gqp9]
[h4]
[i1\|l\!]
[j]
[k(\/\<)(\|\<)]
[Li71\|]
m
[n]
[o0(\(\))\*\.]
[qgp9]
[qgp9]
r
[s5\$]
[t7\+]
[u]
[v(\\\/)]
[w(vv)]
[x(\>\<)]
[y]
[z2]

Put this between each letter to catch characters used for spacing:
[[:punct:][:space:]]*

Commonly Obfuscated Word Regexes

viagr (viagra)
[v(\\\/)][[:punct:][:space:]]*[i1\|l\!]{1,3}[[:punct:][:space:]]*[a\@]{1,3}[[:punct:][:space:]]*[gqp9]{1,3}[[:punct:][:space:]]*r

vicodin
[v(\\\/)][[:punct:][:space:]]*[i1\|l\!]{1,3}[[:punct:][:space:]]*[c6]{1,3}[[:punct:][:space:]]*[o0(\(\))\*\.]{1,3}[[:punct:][:space:]]*[db]{1,3}[[:punct:][:space:]]*[i1\|l\!]{1,3}[[:punct:][:space:]]*[n]

cialis
[c6][[:punct:][:space:]]*[i1\|l\!]{1,3}[[:punct:][:space:]]*[a\@]{1,3}[[:punct:][:space:]]*[Li71\|]{1,3}[[:punct:][:space:]]*[i1\|l\!]{1,3}[[:punct:][:space:]]*[s5\$]

xanax
[x(\>\<)][[:punct:][:space:]]*[a\@]{1,3}[[:punct:][:space:]]*[n]{1,3}[[:punct:][:space:]]*[a\@]{1,3}[[:punct:][:space:]]*[x(\>\<)]

mortg (mortgage)
m[[:punct:][:space:]]*[o0(\(\))\*\.]{1,3}[[:punct:][:space:]]*r{1,3}[[:punct:][:space:]]*[t7\+]{1,3}[[:punct:][:space:]]*[qgp9]

refi (refinance)
r[[:punct:][:space:]]*[e3]{1,3}[[:punct:][:space:]]*f{1,3}[[:punct:][:space:]]*[i1\|l\!]

rolex
r[[:punct:][:space:]]*[o0(\(\))\*\.]{1,3}[[:punct:][:space:]]*[Li71\|]{1,3}[[:punct:][:space:]]*[e3]{1,3}[[:punct:][:space:]]*[x(\>\<)]

pharm
[pq9][[:punct:][:space:]]*[h]{1,3}[[:punct:][:space:]]*[a\@]{0,3}[[:punct:][:space:]]*r{1,3}[[:punct:][:space:]]*m

diploma
[dbo0@][[:punct:][:space:]]*[i1\|l\!]{1,3}[[:punct:][:space:]]*[pq9]{1,3}[[:punct:][:space:]]*[Li71\|]{1,3}[[:punct:][:space:]]*[o0(\(\))\*\.]{1,3}[[:punct:][:space:]]*m{1,3}[[:punct:][:space:]]*[a\@]

penis
[pq9]{1,3}[[:punct:][:space:]]*[e3]{1,3}[[:punct:][:space:]]*[n]{1,3}[[:punct:][:space:]]*[i1\|l\!]{1,3}[[:punct:][:space:]]*[s5\$]

Various Other Spam Catching Regexes

micrrowave|geeneric|genneric|so+f+t+w+a+r+e+s|auto[[:space:]\-]*warranty|dic+k+y|bannedcd2004|c[a\@]ble\-?filter|delete my address|s\.p\.a\.m|s0ft|d[o0][\\\|\/]+a|w[i\|l1]nd|nd0w|Latest FileSharing Software|lifespan enhancement

reach you in order to deliver your free|pleased with what your product has done|Genuine College|(harrasing|awkward|embarras*ing)[[:space:]]*(collection|(((tele)?phone))? calls)|charity contact email|hook[[:space:]\-\_]up site|advanced reporting service|increased?[[:space:]]*(my|your)[[:space:]]*length|using a vibrator

Safe Harbor|Jack Rabbit Vibrator|[il\|1]m[pq][o0]t[e3]nc[e3]|[o0]utstand[1il\|]n[gpq][[:space:]]+[l1i\|][o0][gpq][o0]|degree of choice|End the calls|jet[[:space:]]tan|medlcation|(latest|cheap) software|different brokers|sistem|Online University|mailing of checks|omega or breitlng

(hospital|doctor|medical) directory|unconditional offer|(dating|hookup)[[:space:]]*site|(real|genuine|qualified)[[:space:]]*degree|university[[:space:]]*enroll|GO[[:space:]]{1,2}HERE|getmeoff

banned CD|SCRAMBLER|Nigeria| CONGO,? | Lagos|LOLITA|Sierra\-Leon|guarnat|Free IPOD|to be exclud|Jump\-Line|make her orgasm|eligible for a degree

prescription|perscription|pharmacy|generic|pharms|h[o0]{1,4}d[i\|1]a|[e3]r[o0]t[i1\|]c|Ma[li\|1][e3][[:punct:][:space:]][e3]nhanc[e3]m[e3]nt|d[i1\I\!]scr[e3]{1,3}t|pi11|pri[s\$]e|st0ck|timepiece|wristclock|wrist\-?[[:space:]]?watch|[e3]r[e3]ct|penny st[o0]ck|l\-?[o0]\-?n\-?g\-?z|h[o0]+d[i1l\|]a

Repli[ck]a[[:space:]]Watches|pre[\-]?a[p]{1,3}r[o0]v|swinger|un[\-]?co[li1\|]|dat(e|ing)[[:space:]]*site|company summary|forward[[[:space:]]|\-]?looking|target[ \-\_]*price|ejaculat|h0m|[lI\|]0an

(.*float[[:space:]]*:[[:space:]]*(right|left).*){4}

Subject contains:
(ebay|starbucks|mcdonalds|subway|depot|pepsi)[[:space:]]*(member|customer)

Return to Free Spam Filtering Tactics Using Eudora