Found at the bottom of the Analysis - INKY page you’ll find the new section named Additional Analysis. There you’ll use a multi-select input to set which country you want blocked.

Blocked Sender Location

When you block a country, any message that’s identified coming from there will be given the new threat category “Blocked Sender Location” and tagged as High Confidence Phish. This allows it to follow the normal routing destinations defined on the delivery page, which would likely send them to Admin Quarantine.

Additionally, within the message details view of most messages after October 2022, you’ll have access to the sender location. This helps identify which country you may consider blocking if they’re found being used in phishing attacks.

Block Many Countries

To enhance cybersecurity measures, teams may consider blocking certain countries while ensuring the United States remains accessible. The User Interface (UI) accepts comma-separated values, allowing you to block multiple countries simultaneously with ease. Simply copy one of the country code lists provided below and paste it into the INKY dashboard, followed by pressing enter, to block all countries in the list. We employ the ISO 3166-1 country codes for location-based sender blocking, which can be referenced here. To create a custom block list, please follow the examples below, copying and pasting your constructed list into the INKY dashboard.

Exercise caution when selecting countries like Colombia (.co) and Montenegro (.me) whose ccTLDs are widely used by numerous legitimate companies. While this list is not exhaustive, it provides an example of what may be inadvertently blocked should you opt to restrict these countries.

.tv - Tuvalu: Widely used by television and media-related websites.
.io - British Indian Ocean Territory: Popular among technology and startup companies because "IO" is commonly used as an acronym for input/output in IT.
.me - Montenegro: Often used for personal websites or blogs due to the word "me" being prevalent in English.
.ly - Libya: Used for domain hacks because "ly" is a common suffix (e.g., bit.ly ).
.ai - Anguilla: Gained popularity among AI (Artificial Intelligence) companies and startups.
.co - Colombia: Frequently used by companies as it resembles "com."
.fm - Federated States of Micronesia: Often used by FM radio stations.
.gg - Guernsey: Popular within the gaming community, as "gg" is commonly used to signify "good game."
.to - Tonga: Used for domain hacks and occasionally by Toronto-based entities.
.cc - Cocos (Keeling) Islands: Sometimes used as a generic code for Christian Church or Cycling Club.

NA,PS,BJ,JM,ST,SA,GE,MV,KY,GW,NU,SD,GI,GA,LY,VE,ZM,GU,CH,GL,KR,AR,HR,TM,JE,LT,LK,RW,SL,AD,GH,NI,BH,MA,MH,AM,BQ,NL,CO,VN,TL,EH,NC,MD,PY,PR,ER,FO,NZ,NR,BF,GQ,WS,PK,DJ,SV,CK,AL,CV,TZ,TV,LS,TD,MN,UG,CM,AT,VA,VG,MR,IE,LI,NF,PW,SG,KE,UA,HK,GR,PT,BI,KP,AX,SY,HT,LA,LB,ZW,VC,CF,CD,SR,MO,ME,TT,QA,IO,MY,CX,TG,SS,ET,TW,MT,RO,CC,SB,DZ,MU,GM,CL,NG,MK,MM,TK,EE,HN,KH,FK,LV,UZ,BY,AS,AU,HM,PN,AG,YE,BG,TO,NP,BN,DK,AO,ID,LC,DO,BT,BE,ML,CG,BS,KM,GY,PH,SO,TC,TF,TH,UM,KW,PA,ZA,CW,SM,BO,AI,TR,LR,FJ,FI,GD,MG,IM,VU,CU,BM,BA,JO,HU,DM,KG,IR,CZ,AE,AF,IS,TN,PE,MS,MZ,TJ,MW,KZ,KI,SX,CY,IL,CA,BV,NO,SJ,LU,PF,AZ,OM,MP,PG,FM,SK,BZ,EC,MC,GT,GN,GS,BB,SI,CR,NE,AW,IQ,VI,AQ,BD,BW,GG,CN,SZ,MX,SC,SN,CI,EG,KN,UY,RS,IT,BR,PL,SE,IN,ES,JP,SH,GB,DE,FR,GF,GP,MQ,YT,RE,BL,MF,PM,WF,RU,XK

DZ,AO,BJ,BW,BF,BI,CV,CM,CF,TD,KM,CD,DJ,EG,GQ,ER,SZ,ET,GA,GM,GH,GN,CI,KE,LS,LR,LY,MG,MW,ML,MR,MU,YT,MA,MZ,NA,NE,NG,CG,RE,RW,SH,ST,SN,SC,SL,SO,ZA,SS,SD,TZ,TG,TN,UG,ZM,ZW,EH,GF,TF,HM

AF,AM,AZ,BH,BD,BT,BN,KH,CN,TL,GE,HK,IN,ID,IR,IQ,IL,JP,JO,KZ,KW,KG,LA,LB,MO,MY,MV,MN,MM,NP,KP,OM,PK,PS,QA,RU,SA,SG,KR,LK,SY,TW,TJ,TH,PH,TR,TM,AE,UZ,VN,YE

AL, AD, AT, BY, BE, BA, BG, HR, CZ, DK, EE, FO, FI, FR, DE, GI, GR, GG, VA, HU, IS, IE, IM, IT, JE, XK, LV, LI, LT, LU, MK, MT, MD, MC, ME, NL, NO, PL, PT, RO, RU, SM, RS, SK, SI, ES, SJ, SE, CH, UA, GB, AX

AG, AI, AW, BS, BB, BZ, BM, BQ, VG, CA, KY, CR, CU, CW, DM, DO, SV, GL, GD, GP, GT, HT, HN, JM, MQ, MX, MS, NI, PA, PR, BL, KN, LC, MF, PM, VC, TT, TC, US, VI

Blocked Top-Level Domain

In addition to the current blocked sender location functionality, we’ve added the ability to block top level domains (TLDs) and public suffixes (e.g., co.uk). This blocking mechanism is enforced against the following mail properties.

MAIL FROM envelope address
From or Reply-To header address
Link URLs
Image URLs

Additionally, there's a new feature to "Automatically block ccTLDs (Country Code Top-Level Domains) based on the chosen Blocked Sender Location." For instance, if Montenegro (.me) is selected, its country code will also be considered a Blocked Top-Level Domain, alongside the Blocked Sender Location.

Configure these new settings at the bottom of this page: Analysis - INKY