description = "Phish message with subject trying to address users emotion";
score = 2.0;
}
- UNPRECISE_RCPT_DETAIL_FROM_SPAMMY {
- expression = "TO_DN_NONE & FROM_HAS_DN & (REPLYTO_EQ_FROM | FREEMAIL_FROM | HAS_LIST_UNSUB)";
- description = "Spammy message with detailled sender but generic recipient";
- score = 0.5;
- }
HAS_ANON_DOMAIN {
expression = "HAS_GUC_PROXY_URI | URIBL_RED | DBL_ABUSE_REDIR";
description = "Contains one or more domains trying to disguise owner/destination";