SPAMASSASSIN: Rule examples

mimeheader ZIP_ATTACHED Content-Type =~ /zip/i
describe ZIP_ATTACHED email contains a zip file attachment
score ZIP_ATTACHED 99

## URI rule
URI LOCAL_URI_BITLY /www\.bit.ly\//
score LOCAL_URI_BITLY 99
URI LOCAL_URI_BITLY2 /bit.ly\//
score LOCAL_URI_BITLY2 99

There are 2 rules for bit, for both http://bit.ly and http://www.bit.ly to be filtered.