Puck, the ORBS/RBL service is no longer free. It requires a hefty subscription fee now. The couple that are free are way too tight about who they block. One of the free ones blocks all email from Verizon's network.
You can no longer trust the name of the IP that looks like a user IP for dial-up, DSL, or cable as the stupid ISP's name the addresses all the same, whether it is a business account or a residential user. SWBell, Verizon, Sprint, and AT&T all do this. (See a pattern here,...frakin phone companies).
I ended up writting some tools that analyzes the logs, but still requires human intervention. We actually check each entry in the log that is suspect before committing it to the block list. Takes about 4 hours a day to do this.
As far as filtering goes, SPAMMERS have tools that forges the email header To:/From: lines and uses a rotating/random string of random length compromised of letters/numbers. Makes it virtually impossible to block based on the To:/From: lines. Subject line filtering works for a while, until one of the SPAMMERS figures it out and alters the Subject line. Then they post that information to thier newsgroups and you are back to square one again.
You can't filter based on domain names in most cases, as most SPAMMERS use yahoo.com, msn.com and hotmail.com as the domain name.
As far as IEN SPAMMING people. They could have purchased an email list from many sources.
Oh,..there is one other Java script some sites run which can extract your email address book and send it to them. This only effects people that use MS Outlook or Outlook Express which use the address book feature.
