Are you saying that if there are multiple countries in the path, it will flag all of them? I haven't seen that. For example, one spam I received today was like this:
X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: MXRATE-ALLOW: "GOOD SENDER" X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]" X-RBL-Warning: FILTER-COUNTRY: Message failed FILTER-COUNTRY test (line 228, weight 9) X-Declude-Sender: [EMAIL PROTECTED] [217.146.177.66] X-Declude-Spoolname: 45962141.eml X-Declude-Note: Scanned by Declude 3.0.5.20 (http://www.declude.com/x-note.htm) for spam. X-Declude-Scan: Score [8] at 04:15:22 on 21 Nov 2005 X-Declude-Tests: NOLEGITCONTENT, IPNOTINMX, MXRATE-ALLOW, NOABUSE, FILTER-COUNTRY X-Country-Chain: ISRAEL->UNITED KINGDOM->destination It flagged ISRAEL, but not UNITED KINGDOM. And yes there is a test for UK in the filter file. -------- Original Message -------- > From: "Scott Fisher" <[EMAIL PROTECTED]> > Sent: Sunday, November 13, 2005 2:59 PM > To: [email protected] > Subject: Re: [Declude.JunkMail] hops and country code > > COUNTRY 1 CONTAINS DE should trigger as should > COUNTRIES 1 CONTAINS DE and > COUNTRIES 1 CIBTAUBS *A > > Also the country filters were broken in early 3.0.5.x versions. > > ----- Original Message ----- > From: "Gary Steiner" <[EMAIL PROTECTED]> > To: <[email protected]> > Sent: Sunday, November 13, 2005 12:36 AM > Subject: Re: [Declude.JunkMail] hops and country code > > > That won't work. I have a country filter, and it saw the DE but not the > multicast. Apparently the test only sees part of the chain. > > > -------- Original Message -------- > > From: "Scott Fisher" <[EMAIL PROTECTED]> > > Sent: Saturday, November 12, 2005 6:50 PM > > To: [email protected] > > Subject: Re: [Declude.JunkMail] hops and country code > > > > COUNTRIES 1 CONTAINS *M or > > COUNTRIES 1 STARTSWITH *M > > > > Special country codes: > > # > > # Special Codes > > # > > #*1 Multi-Regional > > #*2 Europe > > #*3 North America > > #*4 Central/South America > > #*5 Pacific Rim > > #*A ARIN Unlisted (North America/South Africa) > > #*B Public Data Network > > #*E RIPE Unlisted (Europe, North Africa, Middle East) > > #*I Private IP > > #*L Loopback > > #*M Multicast > > #*P APNIC Unlisted (Asia Pacific) > > #*R IANA Reserved > > #*U Unknown > > > > > > ----- Original Message ----- > > From: "Gary Steiner" <[EMAIL PROTECTED]> > > To: <[email protected]> > > Sent: Saturday, November 12, 2005 12:47 PM > > Subject: [Declude.JunkMail] hops and country code > > > > > > I have a spam that produce the following: > > > > X-Country-Chain: [Multicast]->GERMANY->destination > > > > The country code check flagged it as Germany (DE). Is there any way to > > flag > > both hops? I'm using the default setting which has HOP set to 0. > > > > Thanks, > > > > Gary > > > > --- > > [This E-mail scanned for viruses by Declude Virus] > > > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > --- > > [This E-mail scanned for viruses by Declude Virus] > > > --- > [This E-mail scanned for viruses by Declude Virus] > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
