Agreed. But there is a 'problem' of some kind for it not to trigger when visually it looked okay. Once again, I wonder if 'high-bits' or unprintable characters are being used somehow? I expect I'll get more of these, so I'll forward the next one I get.....
Suggested test rules to see if a hi-bit or control character is being used:
uri LOCAL_URI_HIBIT /[\x80-\xFF]/ score LOCAL_URI_HIBIT 0.01
uri LOCAL_URI_CTRL /[\x00-\x1f]/ score LOCAL_URI_CTRL 0.01