Help with rule for geocities spam

[Kenneth Porter]

I just grepped my entire mail hierarchy for ".geocities.com" and the only 
legitimate stuff I see either uses the www or uk subdomains. How can I 
write a rule that matches on that? If it were just one subdomain I could 
write one rule for all subdomains and one for just the one subdomain and 
use a negative score for the latter to match the positive score for the 
all-subdomain rule. But how do I handle two "good" subdomains?