meta     PDS_BAD_THREAD_QP_64 __PDS_QP_64 && __HAS_THREAD_INDEX && !__THREAD_INDEX_GOOD
describe PDS_BAD_THREAD_QP_64 Bad thread header - short QP
score    PDS_BAD_THREAD_QP_64 1.0

header  __PDS_TO_BRAND_SUBJECT ALL =~ /^To:\s+<?[^\@]+\@([^\.]+)\.(?:[^\n]+\n)*^Subject: \"?\1\b/ism

meta     PDS_BRAND_SUBJ_NAKED_TO __NAKED_TO && __PDS_TO_BRAND_SUBJECT
describe PDS_BRAND_SUBJ_NAKED_TO Subject starts with To: brand and naked To:
score    PDS_BRAND_SUBJ_NAKED_TO 1.0

header   __PDS_FROM_GMAIL From:addr =~ /\@g(?:oogle)?mail\.com$/i
header   __PDS_GMAIL_MID Message-Id =~ /\@mail.gmail.com>$/

meta     SPOOF_GMAIL_MID SPOOFED_FREEMAIL && __PDS_FROM_GMAIL && !__PDS_GMAIL_MID
score    SPOOF_GMAIL_MID 1.5
describe SPOOF_GMAIL_MID From Gmail but it doesn't seem to be...

header   __PDS_RDNS_MTA X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*(mta|mail|mx|smtp)\b\S* /i

meta     PDS_RDNS_DYNAMIC_FP RDNS_DYNAMIC && !__PDS_RDNS_MTA
score    PDS_RDNS_DYNAMIC_FP 0.01
describe PDS_RDNS_DYNAMIC_FP RDNS_DYNAMIC with FP steps

header   __PDS_FROM_NAME_TO_DOMAIN  ALL =~ /From: ["']?([a-z0-9\.-]+\.[0-9a-z\.-]+)["']? [^\n]+\nTo:[^\n]+\@\1/ism

meta     PDS_SHORT_BOGUS_MSM_HDRS __PDS_HTML_LENGTH_1024 && __BOGUS_MSM_HDRS
score    PDS_SHORT_BOGUS_MSM_HDRS 2.0
describe PDS_SHORT_BOGUS_MSM_HDRS Short HTML email with bogus MSM headers

meta     PDS_FROM_NAME_TO_DOMAIN __PDS_FROM_NAME_TO_DOMAIN
score    PDS_FROM_NAME_TO_DOMAIN 2.0
describe PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain

meta     PDS_FRNOM_TODOM_NAKED_TO __NAKED_TO && PDS_FROM_NAME_TO_DOMAIN
describe PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain
score    PDS_FRNOM_TODOM_NAKED_TO 1.5

rawbody    __PDS_HIDDEN_UK_BUSINESSLOAN /style="[^"]*display:none[^"]*">.*UK's [a-z]+ rates for business loans/

meta     PDS_HIDDEN_UK_BUSINESSLOAN __PDS_HIDDEN_UK_BUSINESSLOAN
describe PDS_HIDDEN_UK_BUSINESSLOAN UK's <word> rates for business loans
score    PDS_HIDDEN_UK_BUSINESSLOAN 2.0 # limit
reuse    PDS_HIDDEN_UK_BUSINESSLOAN

uri  __PDS_DOUBLE_URL m;https?://[\S]+(?:\?|=)https?://[\S]+[\w]+$;

meta     PDS_FRNOM_TODOM_DBL_URL PDS_FROM_NAME_TO_DOMAIN && __PDS_DOUBLE_URL
describe PDS_FRNOM_TODOM_DBL_URL From Name to domain, double URL
score    PDS_FRNOM_TODOM_DBL_URL 1.5

meta     PDS_DBL_URL_HELO_NODOM __PDS_DOUBLE_URL && (__HELO_NO_DOMAIN && !HELO_LOCALHOST)
describe PDS_DBL_URL_HELO_NODOM URL that ends with a URL, HELO not a domain
score    PDS_DBL_URL_HELO_NODOM 1.0

meta     PDS_DOUBLE_URL __PDS_DOUBLE_URL
describe PDS_DOUBLE_URL URL that ends with a URL
score    PDS_DOUBLE_URL 1.0 # limit
reuse    PDS_DOUBLE_URL

meta     PDS_DBL_URL_LINKBAIT __BODY_URI_ONLY && __PDS_DOUBLE_URL
describe PDS_DBL_URL_LINKBAIT Linkbait double-url
score    PDS_DBL_URL_LINKBAIT 2.5 # limit
reuse    PDS_DBL_URL_LINKBAIT

meta     PDS_DBL_URL_TNB_RUNON __TO_NO_BRKTS_FROM_RUNON && __PDS_DOUBLE_URL
describe PDS_DBL_URL_TNB_RUNON Double-url and To no arrows, from runon
score    PDS_DBL_URL_TNB_RUNON 2.0
reuse    PDS_DBL_URL_TNB_RUNON

meta     PDS_DBL_URL_ILLEGAL_CHARS SUBJ_ILLEGAL_CHARS && __PDS_DOUBLE_URL
describe PDS_DBL_URL_ILLEGAL_CHARS Double url illegal subject characters
score    PDS_DBL_URL_ILLEGAL_CHARS 2.0
reuse    PDS_DBL_URL_ILLEGAL_CHARS

meta     FROM_2_EMAILS_SHORT __KAM_BODY_LENGTH_LT_512 && (__PDS_FROM_2_EMAILS || __NAME_EMAIL_DIFF)
describe FROM_2_EMAILS_SHORT Short body and From looks like 2 different emails
score    FROM_2_EMAILS_SHORT 3.0 # limit
reuse    FROM_2_EMAILS_SHORT

body     __PDS_BODY_QUOTE / [\w\s,\.]+ - ([A-Z][a-z'\.]+ ?){1,4}/
header   __PDS_SUBJECT_QUOTE Subject =~ /\bquotes?\b/i

meta     SHORT_BODY_QUOTE  __PDS_SUBJECT_QUOTE && __PDS_BODY_QUOTE && __KAM_BODY_LENGTH_LT_256
describe SHORT_BODY_QUOTE Short body with quote - used for warming up domains
score    SHORT_BODY_QUOTE 2.0
reuse    SHORT_BODY_QUOTE

meta     BODY_QUOTE_MALF_MSGID __MSGID_NOFQDN2 && __PDS_BODY_QUOTE
describe BODY_QUOTE_MALF_MSGID Malformed MSGID with quote
score    BODY_QUOTE_MALF_MSGID 2.0
reuse    BODY_QUOTE_MALF_MSGID

meta     SPOOFED_FREEMAIL_NO_RDNS __SPOOFED_FREEMAIL && __RDNS_NONE
describe SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS
score    SPOOFED_FREEMAIL_NO_RDNS 1.5
reuse    SPOOFED_FREEMAIL_NO_RDNS

uri	 __KHOP_URI_HIDDEN	m'.{7}\/\.\.?/?\w'

meta     PDS_URI_HIDDEN_HELO_NO_DOMAIN __HELO_NO_DOMAIN && __KHOP_URI_HIDDEN
describe PDS_URI_HIDDEN_HELO_NO_DOMAIN Hidden URI, HELO not domain
score    PDS_URI_HIDDEN_HELO_NO_DOMAIN 2.0
reuse    PDS_URI_HIDDEN_HELO_NO_DOMAIN

header   __PDS_TONAME_EQ_TOLOCAL To:raw =~ /^\s*['"]?([^'"]+)['"]? <?\1\@/

meta     PDS_TONAME_EQ_TOLOCAL_HDRS_LCASE __PDS_TONAME_EQ_TOLOCAL && __HDRS_LCASE
describe PDS_TONAME_EQ_TOLOCAL_HDRS_LCASE To: name matches everything in local email - LCASE headers
score    PDS_TONAME_EQ_TOLOCAL_HDRS_LCASE 2.0 # limit
reuse    PDS_TONAME_EQ_TOLOCAL_HDRS_LCASE

meta     PDS_TONAME_EQ_TOLOCAL_SHORT __PDS_TONAME_EQ_TOLOCAL && __KAM_BODY_LENGTH_LT_512
describe PDS_TONAME_EQ_TOLOCAL_SHORT Short body with To: name matches everything in local email
score    PDS_TONAME_EQ_TOLOCAL_SHORT 2.0 # limit
reuse    PDS_TONAME_EQ_TOLOCAL_SHORT

meta     PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE FREEMAIL_FORGED_REPLYTO && __PDS_TONAME_EQ_TOLOCAL
describe PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE Forged replyto and __PDS_TONAME_EQ_TOLOCAL
score    PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE 2.0 # limit
reuse    PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE

meta     PDS_TONAME_EQ_TOLOCAL_VSHORT __KAM_BODY_LENGTH_LT_128 && __PDS_TONAME_EQ_TOLOCAL
describe PDS_TONAME_EQ_TOLOCAL_VSHORT Very short body and From looks like 2 different emails
score    PDS_TONAME_EQ_TOLOCAL_VSHORT 1.0 # limit
reuse    PDS_TONAME_EQ_TOLOCAL_VSHORT