Hi,

If the goal here is to block spam, do consider that spam is sent from distributed botnets all over the world - check out www.symantec.com/spam for the latest State of Spam report detailing the top 10 countries where spam is originating from. The Symantec anti-spam products would already use extensive reputation filters to block known spammy IPs.

A safer method might be to block messages in undesired languages, depending on the specific product being used this may already be possible in your product.

Amanda

Fair enough but we receive a lot of spam that has URL's in the body that end up going to .CN we have attempted to block these to no avail.

Is there a recommendation?

Hi,

Almost 90% of spam is sent by botnet IPs - these usually have no connection with the destination URL in the body of the message.

If spam effectiveness seems to have dropped, there are troubleshooting steps you can perform and information you can gather that can help determine where the issue may be. Check out the Steps to Follow if Seeing Increased Missed Spam section in this article: http://service1.symantec.com/support/ent-gate.nsf/...

Best regards,
Amanda