omo,

SpamFilter uses the GeoIP database from MaxMind - http://maxmind.com. The newest versions of SpamFilter automatically download the updated GeoIP.dat file as we update in on our server. The updates are usually done every 30-60 days, as that data does not change often for the major providers.

Checking those 3 IPs with the current live demo on their website, I do see that all three IPs are currently reported in the same way SpamFilter is reporting them:

What tool are you using to determine the IPs are located in the USA? Please note that the country of the organization that owns the IP range does not necessarily indicate that the IP address themselves are assigned to a device physically located in that country. In the above case, it could be very possible that while Microsoft (with headquarters in the USA) is the owner of the IPs, they could be assigned to devices located in those countries, in which case the Maxmind report is correct.