RE: [Declude.JunkMail] Country Code test

[Kyle Fisher]

Thanks.  I will create a COUNTRIES filter with STARTSWITH   Kyle   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: Friday, April 22, 2005 10:36 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Country Code test   COUNTRY will match only the connecting hop (prior to IPBYPASS settings) and should contain only one value.  COUNTRIES will contain from the first to the last (connecting) hop, and you should be able to test for the first country with a STARTSWITH filter. Your filter didn't match because the connecting hop was US.  The following filter would have hit if you were looking for Korea being the originating hop: COUNTRIES   5    STARTSWITH   KR Alternatively, if you only wanted to know if Korea was anywhere in the chain, especially considering that some zombie spammers will forge headers to mask the true point of origination, you would do the following: COUNTRIES   5   CONTAINS   KR Matt Kyle Fisher wrote: So are there different test for COUNTRIES and COUNTRY.   I have my country-3point.txt test COUNTRY         5          IS         KR   Do I need another test for COUNTRIES?   Kyle   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Scott Fisher Sent: Friday, April 22, 2005 8:52 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Country Code test   KOREA-KR->UNITED STATES->destination would trigger COUNTRIES 1 IS KR But KOREA-KR->UNITED STATES->destination would not trigger COUNTRY 1 IS KR   ----- Original Message ----- From: Kyle Fisher To: Declude.JunkMail@declude.com Sent: Friday, April 22, 2005 8:08 AM Subject: [Declude.JunkMail] Country Code test   Can someone look at this header and tell me why it didn’t fail my country code test for Korea, is it because the final country code was the US.   Kyle   Received: from new-murphey.tenet.edu [198.213.2.103] by esc5.net   (SMTPD32-8.15) id A3D312F022A; Thu, 21 Apr 2005 21:39:15 -0500 Received: (qmail 121684 invoked by uid 4244); 22 Apr 2005 02:39:15 -0000 Delivered-To: [EMAIL PROTECTED] Received: (qmail 123298 invoked from network); 22 Apr 2005 02:39:14 -0000 Received: from unknown (HELO 198.213.2.103) (168.126.18.65)   by new-murphey.tenet.edu with SMTP; 22 Apr 2005 02:39:14 -0000 Received: from dire5.fibertel.com.ar by mt84.fibertel.com.ar (7.0.015)         id 405D7AEB00499223 for [EMAIL PROTECTED]; Fri, 22 Apr 2005 12:33:29 -0700 From: "Y Helms Corp." <[EMAIL PROTECTED]> Date: Fri, 22 Apr 2005 22:34:29 +0300 To: [EMAIL PROTECTED] Subject: Mr.$aver Message-Id: <[EMAIL PROTECTED]> X-Sender: [EMAIL PROTECTED] X-RBL-Warning: SD-STRONG-SPAMDOMAINS: Spamdomain '@hush.com' found: Address of [EMAIL PROTECTED] sent from invalid new-murphey.tenet.edu. X-Declude-Sender: [EMAIL PROTECTED] [198.213.2.103] X-Declude-Spoolname: D63D3012F022A3398.SMD X-Note: This E-mail was scanned by Region 5 ESC using Declude JunkMail for spam. X-Country-Chain: KOREA-KR->UNITED STATES->destination X-Note: Total spam weight of this E-mail is 5 X-Note: Spam tests: IPNOTINMX, NOLEGITCONTENT, SPFFAIL, SD-STRONG-SPAMDOMAINS X-Note: Reverse DNS: new-murphey.tenet.edu ([198.213.2.103]) X-Note: HELO/EHLO Received: new-murphey.tenet.edu X-Note: Header code: e X-Note: Queue name: D63D3012F022A3398.SMD X-RCPT-TO: <[EMAIL PROTECTED]> Status: R X-UIDL: 398308930 -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================