On Tue, 1 Jun 2004, David B Funk wrote: > > > >uri LOC_DIETSITE /[0-9]{3,6}diet\.biz/i > If the message was Quoted-Printable encoded with a bastardized variety > of QP encoding that uses lower-case HEX characters.... > So you need to write two versions of that regex, one for > 'diet\.biz' and one for 'diet=2ebiz'
I've created a rule to look for /^(?:http://)*[^\/]*=/ ... which should catch any use of '='. From there I'll develop some rules. Thanks. - C