On Thu, Jul 22, 2004 at 08:07:34AM +0200, Jesse Houwing wrote: > it is abused quite often in spam. Any chars before the = sign are > discarted and the hostname after the is is used instead, but to the user > the host before the = is shown (nifty).
Heh. Neat. IE++ <G> > But it seesm to do it too harshly, I'll try to find an example from my > corpus that should be tagged, but isn't in this case. Ok, I'd appreciate that. Right now, I tried: http://penistone.opoloveok=com/3/ and that has the rule hit in both 2.6 and 3.0. If I encode in QP and change = to =3D, and also tried a base64 encoding, those also let both version's rules hit. I did a quick look around in my corpus for a spam with an appropriate URL, but didn't see one. -- Randomly Generated Tagline: Hey, if pi == 3, and three == 0, does that make pi == 0? :-) -- Larry Wall in <[EMAIL PROTECTED]>
pgpWNZTsmvMUj.pgp
Description: PGP signature
