#testrules header __FSL_RELAY_GOOGLE X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.google\.com /i header __FSL_ENVFROM_GOOGLE X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@g(?:mail|oogle)\.com /i meta FSL_NOT_FROM_GOOGLE __FSL_ENVFROM_GOOGLE && !__FSL_RELAY_GOOGLE score FSL_NOT_FROM_GOOGLE 2.0 describe FSL_NOT_FROM_GOOGLE Envelope-From GMail or Google but not originated from Google systems header __FSL_RELAY_YAHOO X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.yahoo(?:dns)?\.co(?:m|\.jp) /i header __FSL_ENVFROM_YAHOO X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@yahoo(?:groups)?\./i meta FSL_NOT_FROM_YAHOO __FSL_ENVFROM_YAHOO && !__FSL_RELAY_YAHOO score FSL_NOT_FROM_YAHOO 2.0 describe FSL_NOT_FROM_YAHOO Envelope-From Yahoo or Yahoo Groups but not originated from Yahoo systems header __FSL_RELAY_HOTMAIL X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.hotmail\.com /i header __FSL_ENVFROM_HOTMAIL X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@hotmail\./i header __FSL_ENVFROM_LIVE X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@live\./i meta FSL_NOT_FROM_HOTMAIL (__FSL_ENVFROM_HOTMAIL || __FSL_ENVFROM_LIVE) && !__FSL_RELAY_HOTMAIL score FSL_NOT_FROM_HOTMAIL 2.0 describe FSL_NOT_FROM_HOTMAIL Envelope-From Hotmail/Live but not originated from Hotmail systems header __FSL_RELAY_AOL X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.aol\.com/i header __FSL_ENVFROM_AOL X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@aol\./i meta FSL_NOT_FROM_AOL __FSL_ENVFROM_AOL && !__FSL_RELAY_AOL score FSL_NOT_FROM_AOL 2.0 describe FSL_NOT_FROM_AOL Envelope-From AOL but not originated from AOL systems uri FSL_LINK_AWS_S3_WEB /http:\/\/[^. ]+\.s3-website-[^. ]+\.amazonaws\.com/i score FSL_LINK_AWS_S3_WEB 1.0 describe FSL_LINK_AWS_S3_WEB Contains a link to Amazon S3 website meta FSL_LINK_AWS_S3_WEB_FM (FREEMAIL_FROM && FSL_LINK_AWS_S3_WEB) score FSL_LINK_AWS_S3_WEB_FM 10.0 describe FSL_LINK_AWS_S3_WEB_FM Contains a link to Amazon S3 website and from a freemail address header FSL_UNDISCLOSED_RCPTS To =~ /\bundisclosed[- ]recipients\b/i score FSL_UNDISCLOSED_RCPTS 0.01 describe FSL_UNDISCLOSED_RCPTS To undisclosed recipients header FSL_FROM_INFO_DOM From:addr =~ /\.info$/ score FSL_FROM_INFO_DOM 1.0 describe FSL_FROM_INFO_DOM From address is in .info body FSL_ADV /\bThis(?:\s*is an)? advert(?:isement)?\b/i score FSL_ADV 1.0 describe FSL_ADV This is an advertisement body FSL_OPEN_ATTACH /\b(?:OPEN|VIEW|READ|SEE|YOUR|ARE)\s*(?:THE\s*)?ATTACH(?:ED|MENT)\b?/ score FSL_OPEN_ATTACH 2.0 describe FSL_OPEN_ATTACH DEMANDS that you open the attachment! ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader FSL_OPEN_ATTACH_MH Content-Disposition =~ /\b(?:OPEN|VIEW|READ|SEE|YOUR|ARE)\s*(?:THE\s*)?ATTACH(?:ED|MENT)\b?/ score FSL_OPEN_ATTACH_MH 2.0 describe FSL_OPEN_ATTACH_MH Filename demands that you open the attachment! endif body __FSL_PHISH_UN /\buser\s*name\s*:/i body __FSL_PHISH_PW /\bpass\s*word\s*:/i body __FSL_PHISH_DE /\bdeactivat(?:ed?|ion)\b/i body __FSL_PHISH_MB /\b(?:this|your|you're) (?:e|e-)?mailbox (?:has|is)\b/i body __FSL_PHISH_RV /\bre-?validat(?:ed?|ion)\b/i header __FSL_PHISH_ADMIN From:name =~ /admin(?:istrator)?\b/i meta FSL_PHISH_EMAIL (__FSL_PHISH_UN + __FSL_PHISH_PW + __FSL_PHISH_DE + __FSL_PHISH_MB + __FSL_PHISH_RV + __FSL_PHISH_ADMIN) >= 3 score FSL_PHISH_EMAIL 1.0 describe FSL_PHISH_EMAIL Likely phishing for e-mail account details header FSL_ABUSED_WEB_1 exists:X-AntiAbuse score FSL_ABUSED_WEB_1 0.01 describe FSL_ABUSED_WEB_1 Has X-AntiAbuse header header FSL_ABUSED_WEB_2 exists:X-PHP-Script score FSL_ABUSED_WEB_2 0.01 describe FSL_ABUSED_WEB_2 Has X-PHP-Script header header FSL_ABUSED_WEB_3 exists:X-PHP-Originating-Script score FSL_ABUSED_WEB_3 0.01 describe FSL_ABUSED_WEB_3 Has X-PHP-Originating-Script header body FSL_MY_NAME_IS /\bmy name is\b/i describe FSL_MY_NAME_IS My name is ... score FSL_MY_NAME_IS 1.0 body FSL_SUPPLY /\b(?:i|we|company)\s*(?:can|is|am|are)?\s*(?:sell(?:ing)?|offer(?:ing)?|provid(?:es?|ing|supply(?:ing)))\b/i describe FSL_SUPPLY Something can be supplied score FSL_SUPPLY 1.0 meta FSL_SUPPLY_FM (FREEMAIL_FROM && FSL_SUPPLY) describe FSL_SUPPLY_FM Something can be supplied and from Freemail account score FSL_SUPPLY_FM 1.0 header __FSL_SUBJ_SEO_1 Subject =~ /\bSEO\b/i header __FSL_SUBJ_SEO_2 Subject =~ /\bsearch engine optimi[sz]ation\b/i meta FSL_SUBJ_SEO (__FSL_SUBJ_SEO_1 || __FSL_SUBJ_SEO_2) describe FSL_SUBJ_SEO Search engine optimisation score FSL_SUBJ_SEO 1.0 body __FSL_BODY_SEO_1 /\bSEO\b/ body __FSL_BODY_SEO_2 /\bsearch engine optimi[sz]ation\b/i meta FSL_BODY_SEO (__FSL_BODY_SEO_1 || __FSL_BODY_SEO_2) describe FSL_BODY_SEO Search engine optimisation score FSL_BODY_SEO 1.0 meta FSL_FREEMAIL_SEO (FREEMAIL_FROM && (FSL_SUBJ_SEO || FSL_BODY_SEO)) describe FSL_FREEMAIL_SEO Freemail account offering SEO score FSL_FREEMAIL_SEO 5.0 meta FSL_UNDISCLOSED_BULK (FSL_UNDISCLOSED_RCPTS && (DCC_CHECK || RAZOR2_CHECK || PYZOR_CHECK)) describe FSL_UNDISCLOSED_BULK Undisclosed recipients and bulk signature score FSL_UNDISCLOSED_BULK 3.0 header __FSL_HAS_LIST_UNSUB exists:List-Unsubscribe meta FSL_BULK_SIG ((DCC_CHECK || RAZOR2_CHECK || PYZOR_CHECK) && !__FSL_HAS_LIST_UNSUB) describe FSL_BULK_SIG Bulk signature with no Unsubscribe score FSL_BULK_SIG 1.0 header __FSL_TO_COMMON_ROLE To:addr =~ /^((?:post|web|domain)master|info|sales|(?:tech)?support|(?:sys)?admin(?:istrator)?|abuse|noc|root|security|compliance|registrar)@/i meta FSL_TO_ROLE_BULK (__FSL_TO_COMMON_ROLE && (DCC_CHECK || RAZOR2_CHECK || PYZOR_CHECK)) describe FSL_TO_ROLE_BULK Bulk signature and to a role account score FSL_TO_ROLE_BULK 1.0