Check X-Originating-IP in SLS

[bhemenway]

Can you add the ability to have Xwall compare the X-Originating-IP in Hotmail to SLS lists? I see you recently added a country lookup for X-Originating-IP and I'm using it. However, I'm getting hammered with Hotmail spam sent from the US and I'd like to block based on the X-Originating-IP. I have to allow Hotmail because of our patrons. Either that or is there a way to use wildcards in header blocking? I tried that but could not find a way to block X-Originating-IP:x.x.x.x without including the full 24 bit address.

[maga]

Wildcards in header blocking: I use the Filter string

X-XWall-Spam:*

to mark spam which was detected by any method on an upstream XWall.

There is the wildcard # to represent any count of numeric characters.
You could try something like

X-Originating-IP:#.#.#.#