On Mon, 19 Nov 2018 15:38:58 -0500 Joseph Brennan wrote: > Example: Obvi=9Do=9Dusly yo=9Du=9D ca=9Dn can cha=9Dnge=9D i=9Dt > > In windows-1256, the presence of =9D between characters under > decimal-128 is suspicious, regardless of Bitcoin. It seems like a > simple rule but even rawbody does not check quoted-printable > patterns. Plugin maybe? Has this already been done and I've missed it?
You don't need that, you can simply look for the decoded character in the body.