#testrules
header   __FSL_RELAY_GOOGLE	X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.google\.com /i
header   __FSL_ENVFROM_GOOGLE	X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@g(?:mail|oogle)\.com /i
meta     FSL_NOT_FROM_GOOGLE	__FSL_ENVFROM_GOOGLE && !__FSL_RELAY_GOOGLE
score    FSL_NOT_FROM_GOOGLE	2.0
describe FSL_NOT_FROM_GOOGLE    Envelope-From GMail or Google but not originated from Google systems

header   __FSL_RELAY_YAHOO      X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.yahoo(?:dns)?\.co(?:m|\.jp) /i
header   __FSL_ENVFROM_YAHOO    X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@yahoo(?:groups)?\./i
meta     FSL_NOT_FROM_YAHOO     __FSL_ENVFROM_YAHOO && !__FSL_RELAY_YAHOO
score    FSL_NOT_FROM_YAHOO     2.0
describe FSL_NOT_FROM_YAHOO     Envelope-From Yahoo or Yahoo Groups but not originated from Yahoo systems

header   __FSL_RELAY_HOTMAIL    X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.hotmail\.com /i
header   __FSL_ENVFROM_HOTMAIL  X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@hotmail\./i
header   __FSL_ENVFROM_LIVE     X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@live\./i
meta     FSL_NOT_FROM_HOTMAIL   (__FSL_ENVFROM_HOTMAIL || __FSL_ENVFROM_LIVE) && !__FSL_RELAY_HOTMAIL
score    FSL_NOT_FROM_HOTMAIL   2.0
describe FSL_NOT_FROM_HOTMAIL   Envelope-From Hotmail/Live but not originated from Hotmail systems

header   __FSL_RELAY_AOL        X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.aol\.com/i
header   __FSL_ENVFROM_AOL      X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@aol\./i
meta     FSL_NOT_FROM_AOL       __FSL_ENVFROM_AOL && !__FSL_RELAY_AOL
score    FSL_NOT_FROM_AOL       2.0
describe FSL_NOT_FROM_AOL       Envelope-From AOL but not originated from AOL systems

uri      FSL_LINK_AWS_S3_WEB	/http:\/\/[^. ]+\.s3-website-[^. ]+\.amazonaws\.com/i
score    FSL_LINK_AWS_S3_WEB    1.0
describe FSL_LINK_AWS_S3_WEB    Contains a link to Amazon S3 website

meta     FSL_LINK_AWS_S3_WEB_FM (FREEMAIL_FROM && FSL_LINK_AWS_S3_WEB)
score    FSL_LINK_AWS_S3_WEB_FM 10.0
describe FSL_LINK_AWS_S3_WEB_FM Contains a link to Amazon S3 website and from a freemail address

header   FSL_UNDISCLOSED_RCPTS  To =~ /\bundisclosed[- ]recipients\b/i
score    FSL_UNDISCLOSED_RCPTS  0.01
describe FSL_UNDISCLOSED_RCPTS  To undisclosed recipients

header   FSL_FROM_INFO_DOM      From:addr =~ /\.info$/
score    FSL_FROM_INFO_DOM      1.0
describe FSL_FROM_INFO_DOM      From address is in .info

body     FSL_ADV                /\bThis(?:\s*is an)? advert(?:isement)?\b/i
score    FSL_ADV                1.0
describe FSL_ADV                This is an advertisement

body     FSL_OPEN_ATTACH        /\b(?:OPEN|VIEW|READ|SEE|YOUR|ARE)\s*(?:THE\s*)?ATTACH(?:ED|MENT)\b?/
score    FSL_OPEN_ATTACH        2.0
describe FSL_OPEN_ATTACH        DEMANDS that you open the attachment!

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader FSL_OPEN_ATTACH_MH   Content-Disposition =~ /\b(?:OPEN|VIEW|READ|SEE|YOUR|ARE)\s*(?:THE\s*)?ATTACH(?:ED|MENT)\b?/
score      FSL_OPEN_ATTACH_MH   2.0
describe   FSL_OPEN_ATTACH_MH   Filename demands that you open the attachment!
endif

body     __FSL_PHISH_UN         /\buser\s*name\s*:/i
body     __FSL_PHISH_PW         /\bpass\s*word\s*:/i
body     __FSL_PHISH_DE         /\bdeactivat(?:ed?|ion)\b/i
body     __FSL_PHISH_MB         /\b(?:this|your|you're) (?:e|e-)?mailbox (?:has|is)\b/i
body     __FSL_PHISH_RV         /\bre-?validat(?:ed?|ion)\b/i
header   __FSL_PHISH_ADMIN      From:name =~ /admin(?:istrator)?\b/i
meta     FSL_PHISH_EMAIL        (__FSL_PHISH_UN + __FSL_PHISH_PW + __FSL_PHISH_DE + __FSL_PHISH_MB + __FSL_PHISH_RV + __FSL_PHISH_ADMIN) >= 3
score    FSL_PHISH_EMAIL        1.0
describe FSL_PHISH_EMAIL        Likely phishing for e-mail account details

header   FSL_ABUSED_WEB_1       exists:X-AntiAbuse
score    FSL_ABUSED_WEB_1       0.01
describe FSL_ABUSED_WEB_1       Has X-AntiAbuse header

header   FSL_ABUSED_WEB_2       exists:X-PHP-Script
score    FSL_ABUSED_WEB_2       0.01
describe FSL_ABUSED_WEB_2       Has X-PHP-Script header

header   FSL_ABUSED_WEB_3       exists:X-PHP-Originating-Script
score    FSL_ABUSED_WEB_3       0.01
describe FSL_ABUSED_WEB_3       Has X-PHP-Originating-Script header