BASTED Geocities spam from Brazil

[Michael S.]

We currently have the follow rules in place to stop these bloody Geocites
spam messages;

 

# Geocities Crap

uri PROLO_PUBWEB_UKGEO_CHECK1 /^http:\/\/.*\.geocities\.com\//

score PROLO_PUBWEB_UKGEO_CHECK1 8.0

describe PROLO_PUBWEB_UKGEO_CHECK1 PROLO_PUBWEB_UKGEO_CHECK1, Body

 

The problem is, geocities.com.br spam is on the rise and all of those are
being delivered.

 

Can somebody rewrite the rules above to include geocities.* and
geocities.*.*

 

I think it would help a lot of people here.

 

Thank you.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20060305/335a9a93/attachment.html