Ok, I gave it a shot..
This rule *does* work.
uri GEOCITIES /^http:\/\/[a-z0-9-]{1,30}\.geocities\.com\b/i
describe GEOCITIES High amounts of spam from Geocities.
score GEOCITIES 6.01
This rule does NOT work.
uri GEOCITIES_YAHOO
/^http:\/\/[a-z0-9-]{1,30}\.geocities\.yahoo\.com\.br\b/i
describe GEOCITIES_YAHOO High amounts of spam from Geocities.
score GEOCITIES_YAHOO 6.01
My regexp foo is non existent, but at least I *did* try. Can someone
tell me what went wrong? :-)
(I get a LOT of spam with geocities dot yahoo dot com dot br slipping
through. Bayes isn't catching it. One slipped through earlier..
X-Spam-Status: No, score=1.951 tagged_above=-999 required=6
tests=[DATE_IN_FUTURE_06_12=1.498, SARE_SUB_GETRID=0.151,
SARE_SUB_MISC_1=0.302]
