header L_AV_Phish      X-Amavis-AV-Status =~ m{\b(Email|HTML)\.Phishing\.}i
header L_AV_SS_Phish   X-Amavis-AV-Status =~ m{\b(Email|Html)\.Phishing(\.[^., ]*)*\.Sanesecurity\.}
header L_AV_SS_Scam    X-Amavis-AV-Status =~ m{\b(Email|Html)\.(Scam[A-Za-z0-9]?)(\.[^., ]*)*\.Sanesecurity\.}
header L_AV_SS_Spam    X-Amavis-AV-Status =~ m{\b(Email|Html)\.(Spam|Bou|Stk|Loan|Cred|Job|Dipl|Doc) (\.[^., ]*)*\.Sanesecurity\.}
header L_AV_SS_Hdr     X-Amavis-AV-Status =~ m{\b(Email|Html)\.Hdr(\.[^., ]*)*\.Sanesecurity\.}
header L_AV_SS_Img     X-Amavis-AV-Status =~ m{\b(Email|Html)\.(Img|ImgO)(\.[^., ]*)*\.Sanesecurity\.}
header L_AV_MSRBL_Img  X-Amavis-AV-Status =~ m{\bMSRBL-Images/}
header L_AV_MSRBL_Spam X-Amavis-AV-Status =~ m{\bMSRBL-SPAM\.}

score  L_AV_Phish      14
score  L_AV_SS_Phish   -3
score  L_AV_SS_Scam    8
score  L_AV_SS_Spam    8
score  L_AV_SS_Hdr     6
score  L_AV_SS_Img     3.5
score  L_AV_MSRBL_Img  3.5
score  L_AV_MSRBL_Spam 6