header   __NUMBERONLY_TLD From:addr =~ /\@[0-9]{4,}(\.[a-z]{2,4})?\.[a-z]+$/i
reuse    __NUMBERONLY_TLD

header   __NUMBEREND_TLD From:addr =~ /\@[a-z]{2,}[0-9]{4,}(\.[a-z]{2,4})?\.[a-z]+$/i
reuse    __NUMBEREND_TLD

meta     NUMBEREND_LINKBAIT __NUMBEREND_TLD && __LCL__KAM_BODY_LENGTH_LT_1024 && __BODY_URI_ONLY
describe NUMBEREND_LINKBAIT Domain ends in a large number and very short body with link
score    NUMBEREND_LINKBAIT 1.0 # limit
reuse    NUMBEREND_LINKBAIT

meta     NUMBERONLY_BITCOIN_EXP __NUMBERONLY_TLD && __BITCOIN_ID && __NAKED_TO
describe NUMBERONLY_BITCOIN_EXP Domain ends in a large number and very short body with link
score    NUMBERONLY_BITCOIN_EXP 1.0 # limit
reuse    NUMBERONLY_BITCOIN_EXP

# _AUTHORDOMAIN_ implemented only from 3.4.1
if (version >= 3.004001)
ifplugin Mail::SpamAssassin::Plugin::AskDNS

askdns     __FROM_FMBLA_NEWDOM    _AUTHORDOMAIN_.fresh.fmb.la. A /^127\.2\.0\.2$/
tflags     __FROM_FMBLA_NEWDOM    net

askdns     __FROM_FMBLA_NEWDOM14  _AUTHORDOMAIN_.fresh.fmb.la. A /^127\.2\.0\.14$/
tflags     __FROM_FMBLA_NEWDOM14  net

askdns     __FROM_FMBLA_NEWDOM28  _AUTHORDOMAIN_.fresh.fmb.la. A /^127\.2\.0\.28$/
tflags     __FROM_FMBLA_NEWDOM28  net

askdns     __FROM_FMBLA_NDBLOCKED _AUTHORDOMAIN_.fresh.fmb.la. A /^127\.255\.255\.255$/
tflags     __FROM_FMBLA_NDBLOCKED net

meta       FROM_FMBLA_NEWDOM    __FROM_FMBLA_NEWDOM
describe   FROM_FMBLA_NEWDOM    From domain was registered in last 7 days
tflags     FROM_FMBLA_NEWDOM    net
score      FROM_FMBLA_NEWDOM    1.5 # limit
reuse      FROM_FMBLA_NEWDOM

meta       FROM_FMBLA_NEWDOM14  __FROM_FMBLA_NEWDOM14
describe   FROM_FMBLA_NEWDOM14  From domain was registered in last 7-14 days
tflags     FROM_FMBLA_NEWDOM14  publish net
score      FROM_FMBLA_NEWDOM14  1.0 # limit
reuse      FROM_FMBLA_NEWDOM14

meta       FROM_FMBLA_NEWDOM28  __FROM_FMBLA_NEWDOM28
describe   FROM_FMBLA_NEWDOM28  From domain was registered in last 14-28 days
tflags     FROM_FMBLA_NEWDOM28  net publish
score      FROM_FMBLA_NEWDOM28  0.8 # limit
reuse      FROM_FMBLA_NEWDOM28

meta       FROM_FMBLA_NDBLOCKED __FROM_FMBLA_NDBLOCKED
describe   FROM_FMBLA_NDBLOCKED ADMINISTRATOR NOTICE: The query to fresh.fmb.la was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists\#dnsbl-block for more information.
tflags     FROM_FMBLA_NDBLOCKED net publish
score      FROM_FMBLA_NDBLOCKED 0.001 # limit
reuse      FROM_FMBLA_NDBLOCKED

meta     __PDS_NEWDOMAIN  (__FROM_FMBLA_NEWDOM || __FROM_FMBLA_NEWDOM14 || __FROM_FMBLA_NEWDOM28)
tflags   __PDS_NEWDOMAIN  net
reuse    __PDS_NEWDOMAIN

meta     FROM_NUMBERO_NEWDOMAIN __NUMBERONLY_TLD && __PDS_NEWDOMAIN
describe FROM_NUMBERO_NEWDOMAIN Fingerprint and new domain
score    FROM_NUMBERO_NEWDOMAIN 2.0 # limit
tflags   FROM_NUMBERO_NEWDOMAIN net publish
reuse    FROM_NUMBERO_NEWDOMAIN

endif

endif