On Mon, 19 Nov 2018 13:31:47 -0800 (PST) John Hardin wrote: > On Mon, 19 Nov 2018, Joseph Brennan wrote: > > > Example: Obvi=9Do=9Dusly yo=9Du=9D ca=9Dn can cha=9Dnge=9D i=9Dt > > > > In windows-1256, the presence of =9D between characters under > > decimal-128 is suspicious, regardless of Bitcoin. It seems like a > > simple rule but even rawbody does not check quoted-printable > > patterns. Plugin maybe? Has this already been done and I've missed > > it? > > It's there, but performing poorly: > > https://ruleqa.spamassassin.org/20181119-r1846888-n/__UNICODE_OBFU_ZW/detail
For this to work with 'normalize_charset 1', \x9d needs to be replaced with (?:\x9d|\xe2\x80\x8c)
