BASTED Geocities spam from Brazil

[Raymond Dijkxhoorn]

Hi!

> uri PROLO_PUBWEB_UKGEO_CHECK1 /^http:\/\/.*\.geocities\.com\//
> score PROLO_PUBWEB_UKGEO_CHECK1 8.0
> describe PROLO_PUBWEB_UKGEO_CHECK1 PROLO_PUBWEB_UKGEO_CHECK1, Body
>
> The problem is, geocities.com.br spam is on the rise and all of those are
> being delivered.

You are using a old version of the rule ;)

uri PROLO_PUBWEB_GEOSPAM        /^http:\/\/((asia|br|ar|it|uk|sg|ca|www|au|in|mx|de|es)\.)?geocities(\.yahoo)?\.com(\.br)?\//
score PROLO_PUBWEB_GEOSPAM      12.0
describe PROLO_PUBWEB_GEOSPAM   PROLO_PUBWEB_GEO, Body

Bye,
Raymond.