body A4A_PORNSCAM_WORD /(P0RNOGRAPlC|P-?0-?R-?N|REC0RDED|M+A+S+T+U+R+B+A+T+E)/
score A4A_PORNSCAM_WORD 0.2
describe A4A_PORNSCAM_WORD Common obfuscations in sextortion scam

body A4A_BITCOIN_OBFUSCATED /[13][ \-]([a-km-zA-HJ-NP-Z0-9][ \-]){25,32}[a-km-zA-HJ-NP-Z0-9]/
score A4A_BITCOIN_OBFUSCATED 0.2
describe A4A_BITCOIN_OBFUSCATED Appears to be an obfuscated bitcoin address

meta A4A_BITCOIN_PORNSCAM A4A_PORNSCAM_WORD && A4A_BITCOIN_OBFUSCATED
score A4A_BITCOIN_PORNSCAM 4.0
describe A4A_BITCOIN_PORNSCAM Sextortion keyword + obfuscated Bitcoin ID