rawbody  __HAS_IMG_SRC_DATA  /^[^>].*?<img src=['"]data/im

meta     __PDS_BTC_ID   ( __BITCOIN_ID && !__URL_BTC_ID && !__HAS_IMG_SRC_DATA && !__BUGGED_IMG)

uri      __URL_LTC_ID     m;[/.][LM3][a-km-zA-HJ-NP-Z1-9]{26,33}(?:/|$);
body     __LITECOIN_ID   /\b(?<!=)[LM3][a-km-zA-HJ-NP-Z1-9]{26,33}\b/

meta     __PDS_LITECOIN_ID (__LITECOIN_ID && !__URL_LTC_ID && !__HAS_IMG_SRC_DATA && !__BUGGED_IMG)

meta     PDS_LITECOIN_ID __PDS_LITECOIN_ID
describe PDS_LITECOIN_ID FP reduced Litecoin ID
score    PDS_LITECOIN_ID 0.5
reuse    PDS_LITECOIN_ID

meta     LITECOIN_EXTORT_01      __PDS_LITECOIN_ID && __EXTORT_MANY
describe LITECOIN_EXTORT_01      Extortion spam, pay via BitCoin
score    LITECOIN_EXTORT_01      5.000	# limit

meta     PDS_LTC_CP   __PDS_LITECOIN_ID && ( __COPY_PASTE_FR || __COPY_PASTE_DE || __COPY_PASTE_ES || __COPY_PASTE_EN || __COPY_PASTE_FR || __COPY_PASTE_IT || __COPY_PASTE_NL || __COPY_PASTE_SE)
describe PDS_LTC_CP   Localized Bitcoin scam
score    PDS_LTC_CP   3.0 # limit

meta     PDS_LTC_HUSH __HUSH_HUSH && __PDS_LITECOIN_ID
describe PDS_LTC_HUSH LTC, it is between us
score    PDS_LTC_HUSH 2.5 # limit

meta     PDS_BTC_ID __PDS_BTC_ID
describe PDS_BTC_ID FP reduced Bitcoin ID
score    PDS_BTC_ID 0.5
reuse    PDS_BTC_ID

meta     PDS_BTC_MSGID __PDS_BTC_ID && __MSGID_NOFQDN2
describe PDS_BTC_MSGID Bitcoin ID with MSGID_NOFQDN2
score    PDS_BTC_MSGID 1.0
reuse    PDS_BTC_MSGID

ifplugin Mail::SpamAssassin::Plugin::ReplaceTags

  replace_rules   __PDS_BTC_HACKER __PDS_BTC_PIRATE

  header   __PDS_BTC_ANON     From:name =~ /\bAnon/
  header   __PDS_BTC_HACKER   From:name =~ /h<A>ck<E>r/i
  header   __PDS_BTC_PIRATE   From:name =~ /p<I>r<A>t<E>/i

  meta     __PDS_BTC_BADFROM     ( __PDS_BTC_HACKER || __PDS_BTC_PIRATE )

  meta     PDS_BTC_AHACKER ( __PDS_BTC_ID && __PDS_BTC_BADFROM && __PDS_BTC_ANON )
  describe PDS_BTC_AHACKER Bitcoin Hacker
  score    PDS_BTC_AHACKER 3.0 # limit
  reuse    PDS_BTC_AHACKER

  meta     PDS_BTC_HACKER ( __PDS_BTC_ID && __PDS_BTC_ANON && !__PDS_BTC_BADFROM )
  describe PDS_BTC_HACKER Bitcoin Hacker
  score    PDS_BTC_HACKER 2.0 # limit
  reuse    PDS_BTC_HACKER

  meta     PDS_LTC_AHACKER ( __PDS_LITECOIN_ID && __PDS_BTC_BADFROM && __PDS_BTC_ANON )
  describe PDS_LTC_AHACKER Litecoin Hacker
  score    PDS_LTC_AHACKER 3.0 # limit
  reuse    PDS_LTC_AHACKER

  meta     PDS_LTC_HACKER ( __PDS_LITECOIN_ID && __PDS_BTC_ANON && !__PDS_BTC_BADFROM )
  describe PDS_LTC_HACKER Litecoin Hacker
  score    PDS_LTC_HACKER 2.0 # limit
  reuse    PDS_LTC_HACKER



endif