BASTED Geocities spam from Brazil

[Raymond Dijkxhoorn]

Hi Jeff,

> Did this rule come from someplace else, or did you cook it up?

>> uri PROLO_PUBWEB_GEOSPAM 
>> /^http:\/\/((asia|br|ar|it|uk|sg|ca|www|au|in|mx|de|es)\.)?geocities(\.yahoo)?\.com(\.br)?\// 
>> score PROLO_PUBWEB_GEOSPAM 12.0 describe PROLO_PUBWEB_GEOSPAM 
>> PROLO_PUBWEB_GEO, Body

Its a combi, you can find a somehow altered one inside SARE also.

Bye,
Raymond.