Re: [Declude.JunkMail] hops and country code

[Nick Hayer]

I believe the COUNTRIES test would flag UK in the example below.  COUNTRY would not - -Nick Gary Steiner wrote: Are you saying that if there are multiple countries in the path, it will flag all of them? I haven't seen that. For example, one spam I received today was like this: X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail detected. X-RBL-Warning: IPNOTINMX: X-RBL-Warning: MXRATE-ALLOW: "GOOD SENDER" X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]" X-RBL-Warning: FILTER-COUNTRY: Message failed FILTER-COUNTRY test (line 228, weight 9) X-Declude-Sender: [EMAIL PROTECTED] [217.146.177.66] X-Declude-Spoolname: 45962141.eml X-Declude-Note: Scanned by Declude 3.0.5.20 (http://www.declude.com/x-note.htm) for spam. X-Declude-Scan: Score [8] at 04:15:22 on 21 Nov 2005 X-Declude-Tests: NOLEGITCONTENT, IPNOTINMX, MXRATE-ALLOW, NOABUSE, FILTER-COUNTRY X-Country-Chain: ISRAEL->UNITED KINGDOM->destination It flagged ISRAEL, but not UNITED KINGDOM. And yes there is a test for UK in the filter file. -------- Original Message -------- From: "Scott Fisher" <[EMAIL PROTECTED]> Sent: Sunday, November 13, 2005 2:59 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] hops and country code COUNTRY 1 CONTAINS DE should trigger as should COUNTRIES 1 CONTAINS DE and COUNTRIES 1 CIBTAUBS *A Also the country filters were broken in early 3.0.5.x versions. ----- Original Message ----- From: "Gary Steiner" <[EMAIL PROTECTED]> To: <Declude.JunkMail@declude.com> Sent: Sunday, November 13, 2005 12:36 AM Subject: Re: [Declude.JunkMail] hops and country code That won't work. I have a country filter, and it saw the DE but not the multicast. Apparently the test only sees part of the chain. -------- Original Message -------- From: "Scott Fisher" <[EMAIL PROTECTED]> Sent: Saturday, November 12, 2005 6:50 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] hops and country code COUNTRIES 1 CONTAINS *M or COUNTRIES 1 STARTSWITH *M Special country codes: # # Special Codes # #*1 Multi-Regional #*2 Europe #*3 North America #*4 Central/South America #*5 Pacific Rim #*A ARIN Unlisted (North America/South Africa) #*B Public Data Network #*E RIPE Unlisted (Europe, North Africa, Middle East) #*I Private IP #*L Loopback #*M Multicast #*P APNIC Unlisted (Asia Pacific) #*R IANA Reserved #*U Unknown ----- Original Message ----- From: "Gary Steiner" <[EMAIL PROTECTED]> To: <Declude.JunkMail@declude.com> Sent: Saturday, November 12, 2005 12:47 PM Subject: [Declude.JunkMail] hops and country code I have a spam that produce the following: X-Country-Chain: [Multicast]->GERMANY->destination The country code check flagged it as Germany (DE). Is there any way to flag both hops? I'm using the default setting which has HOP set to 0. Thanks, Gary --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.