#testrules
header   __FSL_RELAY_GOOGLE	X-Spam-Relays-External =~ /\brdns=[^ ]+\.google\.com\b/i
header   __FSL_ENVFROM_GOOGLE	X-Spam-Relays-External =~ /\benvfrom=[^\@ ]+\@g(?:mail|oogle)\.com\b/i
meta     FSL_NOT_FROM_GOOGLE	__FSL_ENVFROM_GOOGLE && !__FSL_RELAY_GOOGLE
score    FSL_NOT_FROM_GOOGLE	2.0
describe FSL_NOT_FROM_GOOGLE    Envelope-From GMail or Google but not originated from Google systems

header   __FSL_RELAY_YAHOO      X-Spam-Relays-External =~ /\brdns=[^ ]+\.yahoo(?:dns)?\.co(?:m|\.jp)\b/i
header   __FSL_ENVFROM_YAHOO    X-Spam-Relays-External =~ /\benvfrom=[^\@ ]+\@yahoo(?:groups)?\./i
meta     FSL_NOT_FROM_YAHOO     __FSL_ENVFROM_YAHOO && !__FSL_RELAY_YAHOO
score    FSL_NOT_FROM_YAHOO     2.0
describe FSL_NOT_FROM_YAHOO     Envelope-From Yahoo or Yahoo Groups but not originated from Yahoo systems

header   __FSL_RELAY_HOTMAIL    X-Spam-Relays-External =~ /\brdns=[^ ]+\.hotmail\.com\b/i
header   __FSL_ENVFROM_HOTMAIL  X-Spam-Relays-External =~ /\benvfrom=[^\@ ]+\@hotmail\./i
header   __FSL_ENVFROM_LIVE     X-Spam-Relays-External =~ /\benvfrom=[^\@ ]+\@live\./i
meta     FSL_NOT_FROM_HOTMAIL   (__FSL_ENVFROM_HOTMAIL || __FSL_ENVFROM_LIVE) && !__FSL_RELAY_HOTMAIL
score    FSL_NOT_FROM_HOTMAIL   2.0
describe FSL_NOT_FROM_HOTMAIL   Envelope-From Hotmail/Live but not originated from Hotmail systems

header   __FSL_RELAY_AOL        X-Spam-Relays-External =~ /\brdns=[^ ]+\.aol\.com\b/i
header   __FSL_ENVFROM_AOL      X-Spam-Relays-External =~ /\benvfrom=[^\@ ]+\@aol\./i
meta     FSL_NOT_FROM_AOL       __FSL_ENVFROM_AOL && !__FSL_RELAY_AOL
score    FSL_NOT_FROM_AOL       2.0
describe FSL_NOT_FROM_AOL       Envelope-From AOL but not originated from AOL systems

body     FSL_DONT_REPLY         /do not reply/i
score    FSL_DONT_REPLY	        1.0
describe FSL_DONT_REPLY         Contains the phrase 'do not reply'

rawbody  FSL_IMAGE_SHORT        /<img src="?http:\/\/(?:bitly\.com|bit\.ly|j\.mp|amzn\.to)\//i
score    FSL_IMAGE_SHORT        1.0
describe FSL_IMAGE_SHORT        Contains an image pointing to a URL shortener

meta     FSL_IMAGE_SHORT_FM     (FREEMAIL_FROM && FSL_IMAGE_SHORT)
score    FSL_IMAGE_SHORT_FM     2.0
describe FSL_IMAGE_SHORT_FM     Contains an image pointing to a URL shortener and is from a freemail address

rawbody  FSL_LINK_AWS_S3_WEB	/(?:href|src)="?http:\/\/[^. ]+\.s3-website-[^. ]+\.amazonaws\.com/i
score    FSL_LINK_AWS_S3_WEB    1.0
describe FSL_LINK_AWS_S3_WEB    Contains a link to Amazon S3 website

meta     FSL_LINK_AWS_S3_WEB_FM (FREEMAIL_FROM && FSL_LINK_AWS_S3_WEB)
score    FSL_LINK_AWS_S3_WEB_FM 10.0
describe FSL_LINK_AWS_S3_WEB_FM Contains a link to Amazon S3 website and from a freemail address

header   FSL_REPLYTO_NOREPLY    Reply-To:addr =~ /^noreply\@/i
score    FSL_REPLYTO_NOREPLY    1.0
describe FSL_REPLYTO_NOREPLY    Can't reply to the message

header   FSL_FROM_INFO          From:addr =~ /^info\@/i
score    FSL_FROM_INFO          1.0
describe FSL_FROM_INFO          From info@domain.com address

header   FSL_FROM_NEWS          From:addr =~ /^news\@/i
score    FSL_FROM_NEWS          1.0
describe FSL_FROM_NEWS          From news@domain.com address

header   FSL_AOL_SPAM           X-AOL-Global-Disposition =~ /^S/
score    FSL_AOL_SPAM           2.0
describe FSL_AOL_SPAM           AOL thinks the message is spam

header   FSL_PRECEDENCE_JUNK    Precedence =~ /junk/i
score    FSL_PRECEDENCE_JUNK    1.0
describe FSL_PRECEDENCE_JUNK    Sender set the precedence header to 'junk'

header   FSL_UNDISCLOSED_RCPTS  To =~ /Undisclosed[- ]recipients/i
score    FSL_UNDISCLOSED_RCPTS  2.0
describe FSL_UNDISCLOSED_RCPTS  To undisclosed recipients

meta     FSL_SCAM_1             (FREEMAIL_FROM && LOTS_OF_MONEY)
score    FSL_SCAM_1             2.0
describe FSL_SCAM_1             Freemail account discussing lots of money

header   FSL_FROM_INFO_DOM      From:addr =~ /\.info$/
score    FSL_FROM_INFO_DOM      1.0
describe FSL_FROM_INFO_DOM      From address is in .info

body     FSL_ADV                /This is an advertisement/i
score    FSL_ADV                1.0
describe FSL_ADV                This is an advertisement

body     FSL_OPEN_ATTACH        /OPEN THE ATTACHMENT/
score    FSL_OPEN_ATTACH        2.0
describe FSL_OPEN_ATTACH        Demands that you open the attachment