ifplugin Mail::SpamAssassin::Plugin::URIDetail
    uri_detail    MXG_EMAIL_FRAG  raw =~ /^http.*\#[a-zA-Z0-9](?:[a-zA-Z0-9\_\.\-]*[a-zA-Z0-9])?@(?:[a-z0-9_](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9][a-z0-9-]{0,61}[a-z0-9]/i
    score         MXG_EMAIL_FRAG  0.1
    describe      MXG_EMAIL_FRAG  URI with email in fragment

    uri_detail    MXG_BING_REDIR_SUSP  raw =~ /^https?:\/\/(www\.)?bing\.com(:443)?\/ck\//i text =~ /\b(cache|documents?|messages?|now|password|preview|refill|refuel|review|update|verify|view)\b/i
    score         MXG_BING_REDIR_SUSP  0.1
    describe      MXG_BING_REDIR_SUSP  Suspicious Bing redirect

    uri_detail    __MXG_UNSUB_LINK01  text =~ /unsubscribe|opt[\s-]out/i
    uri           __MXG_UNSUB_LINK02  /\b(?:unsub|opt(?:ing)?.?out)\b/i
    rawbody       __MXG_UNSUB_LINK03  /click here<\/a> to unsubscribe/i
    meta          __MXG_UNSUB_LINK  __MXG_UNSUB_LINK01 || __MXG_UNSUB_LINK02 || __MXG_UNSUB_LINK03
    describe      __MXG_UNSUB_LINK  Contains an unsubscribe link

    header        __MXG_LOWER_HDR  ALL:raw =~ /^(from|to|subject):\s/m
    score         __MXG_LOWER_HDR  0.1
    describe      __MXG_LOWER_HDR  lower case header

    meta          MXG_LOWER_HDR_SPAM  (FREEMAIL_FROM || (__FROM_RUNON && __MXG_UNSUB_LINK)) && __MXG_LOWER_HDR
    score         MXG_LOWER_HDR_SPAM  0.1
    describe      MXG_LOWER_HDR_SPAM  Lower case header spam
endif

uri           __MXG_GOOGLE_FOREIGN_REDIR01  /https?:\/\/(www\.)?google\.(com?\.)?\w\w(?<!ca|uk|za)(?<!%{MXG_FROM_TLD})\/(url|amp)/i
meta          MXG_GOOGLE_FOREIGN_REDIR  __MXG_GOOGLE_FOREIGN_REDIR01 && !__MXG_NOT_ENGLISH
score         MXG_GOOGLE_FOREIGN_REDIR  5.000
describe      MXG_GOOGLE_FOREIGN_REDIR  Foreign Google redirect

header        __MXG_SPOOFED_DOCUSIGN01  From:name =~ /docusign/i
header        __MXG_SPOOFED_DOCUSIGN02  Received =~ /\bdocusign\.(com|net)\s/i
meta          MXG_SPOOFED_DOCUSIGN  __MXG_SPOOFED_DOCUSIGN01 && !__MXG_SPOOFED_DOCUSIGN02 && !__VIA_ML
score         MXG_SPOOFED_DOCUSIGN  0.1
describe      MXG_SPOOFED_DOCUSIGN  Docusign spoofing

header        __MXG_NOT_ENGLISH  X-Languages =~ /^(?!en)\w+/
score         __MXG_NOT_ENGLISH  0.1
describe      __MXG_NOT_ENGLISH  Not English

header        __MXG_FROM_TLD  From:addr =~ /\.(?<MXG_FROM_TLD>(?:\w+|com?\.)?\w{2})$/i
describe      __MXG_FROM_TLD  Capture From TLD

header        __MXG_PAYPAL_SCAM01  From:addr =~ /^service@paypal\.com(\.mx)?$/
header        __MXG_PAYPAL_SCAM02  Subject =~ /invoice|estimate|request|reminder from|accept/i
body          __MXG_PAYPAL_SCAM03  /888-221-1161/
meta          MXG_PAYPAL_SCAM  __MXG_PAYPAL_SCAM01 && __MXG_PAYPAL_SCAM02 && (__MXG_HAS_PHONE || T_MXG_PHONE_OBFU) && !__MXG_PAYPAL_SCAM03
score         MXG_PAYPAL_SCAM  0.1
describe      MXG_PAYPAL_SCAM  Paypal scam

body         __MXG_HAS_PHONE01  /\b1?\d{3}[^a-zA-Z0-9]+\d{3}[^a-zA-Z0-9]+\d{4}\b/
body         __MXG_HAS_PHONE02  /\b0[\s)]*(?:\d{3} \d{3} \d{4}|\d{4} \d{6}|\d{4} \d{3} \d{3}|\d{2} \d{4} \d{4})\b/
body         __MXG_HAS_PHONE03  /\b0?(?:\d{1}\)? \d{4} \d{4}|\d{3} \d{3} \d{3})\b/
uri           __MXG_HAS_PHONE04  /tel:/
body         __MXG_HAS_PHONE05  /\+1([\W_]*[0-9]){10}(?![\W_]*[0-9])/
meta          __MXG_HAS_PHONE  __MXG_HAS_PHONE01 || __MXG_HAS_PHONE02 || __MXG_HAS_PHONE03 || __MXG_HAS_PHONE04 || __MXG_HAS_PHONE05
score         __MXG_HAS_PHONE  0.1
describe      __MXG_HAS_PHONE  Has a phone number

body         __MXG_PHONE_OBFU01  /\b[1I]?[\dOIl]{3}[^a-zA-Z0-9]+[\dOIl]{3}[^a-zA-Z0-9]+[\dOIl]{4}\b/
meta          __MXG_PHONE_OBFU  __MXG_PHONE_OBFU01 && !__MXG_HAS_PHONE
score         __MXG_PHONE_OBFU  0.1
describe      __MXG_PHONE_OBFU  Attempt to obfuscate a phone number