BASTED Geocities spam from Brazil

[Jeff A. Earickson]

Raymond,

Did this rule come from someplace else, or did you cook it up?

Jeff Earickson
Colby College

On Sun, 5 Mar 2006, Raymond Dijkxhoorn wrote:

> Date: Sun, 5 Mar 2006 10:25:27 +0100 (CET)
> From: Raymond Dijkxhoorn <raymond at prolocation.net>
> Reply-To: MailScanner discussion <mailscanner at lists.mailscanner.info>
> To: MailScanner discussion <mailscanner at lists.mailscanner.info>
> Subject: Re: BASTED Geocities spam from Brazil
> 
> Hi!
>
>> uri PROLO_PUBWEB_UKGEO_CHECK1 /^http:\/\/.*\.geocities\.com\//
>> score PROLO_PUBWEB_UKGEO_CHECK1 8.0
>> describe PROLO_PUBWEB_UKGEO_CHECK1 PROLO_PUBWEB_UKGEO_CHECK1, Body
>> 
>> The problem is, geocities.com.br spam is on the rise and all of those are
>> being delivered.
>
> You are using a old version of the rule ;)
>
> uri PROLO_PUBWEB_GEOSPAM 
> /^http:\/\/((asia|br|ar|it|uk|sg|ca|www|au|in|mx|de|es)\.)?geocities(\.yahoo)?\.com(\.br)?\//
> score PROLO_PUBWEB_GEOSPAM      12.0
> describe PROLO_PUBWEB_GEOSPAM   PROLO_PUBWEB_GEO, Body
>
> Bye,
> Raymond.
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!