The meta rule COMPENSATION is defined: meta COMPENSATION __COMPENSATION && ... && !__LOCAL_PP_NONPPURL ...
with uri __LOCAL_PP_NONPPURL m'https?://(?:[A-Za-z0-9-_]+)\.(?!paypal\.com)(?:[A-Za-z0-9-_\.]+)'i The name suggests to me that it was intended to hit bogus paypal links. But it actually hits URLs that starts with https?:// but don't start with https?://<something>.paypal.com COMPENSATION can then only fire on emails that contain a link with a paypal.com sub-domain. It also requires !__NOT_SPOOFED. I'm wondering to what extent COMPENSATION is HAS_PAYPAL_LINK && !__DKIM_EXISTS && THROW_MOST_HITS_AWAY
