#testrules
header SMF_BRACKETS_TO To:raw =~ /<<[^<>]+>>/
describe SMF_BRACKETS_TO Double-brackets around To header address
score SMF_BRACKETS_TO 0.01

header SMF_EXTRA_BRKTS_TO To:raw =~ /(?:<<|>>)/
describe SMF_EXTRA_BRKTS_TO Double-brackets in To header
score SMF_EXTRA_BRKTS_TO 0.01

header SMF_EXTRA_BRKTS_CC Cc:raw =~ /(?:<<|>>)/
describe SMF_EXTRA_BRKTS_CC Double-brackets in Cc header
score SMF_EXTRA_BRKTS_CC 0.01

header SMF_EXTRA_BRKTS_FROM From:raw =~ /(?:<<|>>)/
describe SMF_EXTRA_BRKTS_FROM Doube-brackets in From header
score SMF_EXTRA_BRKTS_FROM 0.01

rawbody SMF_HIDDEN_TEXT /<font color="white">[^<]{50,}<\/font>/i
describe SMF_HIDDEN_TEXT Text hidden inside <font> tag
score SMF_HIDDEN_TEXT 0.01

rawbody SMF_SPAMSIG_1 /<br><center><a href="http:\/\/\S+\/(\S+)\.htm"><img src="http:\/\/\S+\/images\/(\1)\.gif" border="0"><\/a><\/center>/i
describe SMF_SPAMSIG_1 Signature seen in mainsleze spam
score SMF_SPAMSIG_1 0.01

body SMF_SPAMSIG_2 /delete spaces before visiting/i
describe SMF_SPAMSIG_2 Signature seen in trap hits
score SMF_SPAMSIG_2 0.01