[Modsecurity] Rule Help

[Chris Holloway]

Can someone please help, I need a rule that blocks any form injection 
for a Brazilian address, .br.  I keep getting spam attacks with almost 
all of the emails destined for .br.  They are getting past the other rules.

I tried this:

SecFilterSelective HTTP_Referer|ARGS ".br"

This actually gets everything with br, so words like broken, or bring 
are blocked. 

I need something more like something at something.br . 

Thanks for the help, I do not want to let these guys by ever again.

Chris