Block entire continets TLD with Filter must be possible? Help

Hi There I have a client that is getting bombarded with Spam, they only do business on the African continent so they want every other country on the planet in a REGEX filter in the From field. My ISP said use this format (I used their example and added the rest - The long one below) but it doesn't work correctly. For example we want to block the addresses ending with the details below but then it blocks fritz@yucky.com (Presumable because it is filtering the ky (Cayman Island) or the .ck (Cook islands) I have a list which blocks the entire planet except, Africa, Seychelles, Mauritius,Madagascar and obviously not .com .net or .org addresses. Once I get the format correct I can add another filter with the new longer TLD's like .capetown, .bikes .cars etc etc Here is my list I want blocked for the customer - well sort of but I need the command to tell it to end after the filtered TLD ==> (ru|uk|ar|jp|sy|ac|ad|ae|af|ag|ai|al|am|an|ao|aq|as|at|au|ba|bb|bd|bf|bg|bh|bi|bj|bl|bm|bn|bo|bq|br|bs|bt|bv|by|bz|ca|cc|cd|cf|cg|ch|ci|ck |cl|cr|cu|cv|cw|cx|cy|cz|de|dj|dk|dm|do|dz|ec|ee|eg|eh|er|es|et|eu|fi|fj|fk|fm|fo|fr|ga|gb|gd|ge|gf|gg|gh|gi|gl|gm|gn|gp|gs|gt|gu|gw|gy|hk |hm|hn|Hr|ht|hu|id|ie|il|im|in|io|iq|ir|it|je|jm|jo|ke|kg|kh|ki|km|kn|kp|kr|kw|ky|kz|la|lb|lc|li|lk|lr|ls|lt|lu|lv|ly|ma|mc|md|me|mf|mg|mh|mk |ml|mm|mn|mo|mp|mq|mr|ms|mt|mu|mv|mw|mx|my|nc|ne|nf|ng|ni|nl|no|np|nr|nu|nz|om|pa|pe|pf|pg|ph|pk|pl|pm|pn|pr|ps|pt|pw|py|qa |ro|rs|sa|sb|sg|sh|si|sj|sk|sm|sr|st|su|sv|sx|sy|tc|tf|th|tj|tk|tl|tm|to|tp|tr|tt|tv|tw|ua|um|us|uy|uz|va|vc|ve|vg|vi|vn|vu|wf|ye|yt)$ This is a test from a .com TLD called info@wingsforlifeworldrun.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The Filter has matched the following condition(s): $header_from: matches (ru|uk|ar|jp|sy|ac|ad|ae|af|ag|ai|al|am|an|ao|aq|as|at|au|ba|bb|bd|bf|bg|bh|bi|bj|bl|bm|bn|bo|bq|br|bs|bt|bv|by|bz|ca|cc|cd|cf|cg|ch|ci|ck|cl|cr|cu|cv|cw|cx|cy|cz|de|dj|dk|dm|do|dz|ec|ee|eg|eh|er|es|et|eu|fi|fj|fk|fm|fo|fr|ga|gb|gd|ge|gf|gg|gh|gi|gl|gm|gn|gp|gs|gt|gu|gw|gy|hk|hm|hn|Hr|ht|hu|id|ie|il|im|in|io|iq|ir|it|je|jm|jo|ke|kg|kh|ki|km|kn|kp|kr|kw|ky|kz|la|lb|lc|li|lk|lr|ls|lt|lu|lv|ly|ma|mc|md|me|mf|mg|mh|mk|ml|mm|mn|mo|mp|mq|mr|ms|mt|mu|mv|mw|mx|my|nc|ne|nf|ng|ni|nl|no|np|nr|nu|nz|om|pa|pe|pf|pg|ph|pk|pl|pm|pn|pr|ps|pt|pw|py|qa|ro|rs|sa|sb|sg|sh|si|sj|sk|sm|sr|st|su|sv|sx|sy|tc|tf|th|tj|tk|tl|tm|to|tp|tr|tt|tv|tw|ua|um|us|uy|uz|va|vc|ve|vg|vi|vn|vu|wf|ye|yt)\$ Match expanded arguments: Subject = info@wingsforlifeworldrun.com Pattern = (ru|uk|ar|jp|sy|ac|ad|ae|af|ag|ai|al|am|an|ao|aq|as|at|au|ba|bb|bd|bf|bg|bh|bi|bj|bl|bm|bn|bo|bq|br|bs|bt|bv|by|bz|ca|cc|cd|cf|cg|ch|ci|ck|cl|cr|cu|cv|cw|cx|cy|cz|de|dj|dk|dm|do|dz|ec|ee|eg|eh|er|es|et|eu|fi|fj|fk|fm|fo|fr|ga|gb|gd|ge|gf|gg|gh|gi|gl|gm|gn|gp|gs|gt|gu|gw|gy|hk|hm|hn|Hr|ht|hu|id|ie|il|im|in|io|iq|ir|it|je|jm|jo|ke|kg|kh|ki|km|kn|kp|kr|kw|ky|kz|la|lb|lc|li|lk|lr|ls|lt|lu|lv|ly|ma|mc|md|me|mf|mg|mh|mk|ml|mm|mn|mo|mp|mq|mr|ms|mt|mu|mv|mw|mx|my|nc|ne|nf|ng|ni|nl|no|np|nr|nu|nz|om|pa|pe|pf|pg|ph|pk|pl|pm|pn|pr|ps|pt|pw|py|qa|ro|rs|sa|sb|sg|sh|si|sj|sk|sm|sr|st|su|sv|sx|sy|tc|tf|th|tj|tk|tl|tm|to|tp|tr|tt|tv|tw|ua|um|us|uy|uz|va|vc|ve|vg|vi|vn|vu|wf|ye|yt)$ Condition is false: $header_from: is cccccccccccc@gmail.com Return-path copied from sender Sender = xxxxxx@xxx.aserv.co.za Recipient = xxxxxxx@xxxx.aserv.co.za Testing Exim filter file "/etc/vfilters/sxxxe.co.za" Deliver message to: test@xxxxxxxxx.co.za Filtering set up at least one significant delivery or other action. No other deliveries will occur. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~END TEST Any and all suggestions will be welcome. I can't rely on the Quarantine blacklist as it's too much work to manually go through it and check. The Spammers are also sending spam and Lockey Viruses from say mike@mmcorp.co.za to mike@mmcorp.co.za and people are opening these obvious emails and giving me a lot of work.