I currently have the following rules in Spamassasin. I have my spam threshold set at 3.8 which is why I have the score at 4. The rules below have blocked emails with malware or **** links in them. To date I have never had a legitimate email fall foul of the rules below. I would recommend that Spamassin sets as default that if the URL is in the spamhaus, Barracuda etc blacklists that the email goes to the spam folder. We have not had one legitimate email affected by these rules below. Thank you.

score URIBLDBLABUSEMALW 4.0
score URIBLMWSURBL 4.0
score URIBLBLACK 4.0
score URIBLDBLSPAM 4.0
score URIBLABUSESURBL 4.0
score URIBLSBLA  4.0
score URIBL_SBL  4.0