Hi all, I've gone through several hundred emails and found a pattern. the vast majority of these emails are coming from random domain names in the following TLDs: .bid .stream .trade I've found 328 such emails, 298 of which come from unique IP addresses. I'm going to add those to my firewall rules on a temporary basis, ready for the overnight influx of spam. Note that if one has clients dependent on filtering, this IS NOT the right way to deal with spam - it's too easy to block the wrong IPs - but it's ok in an emergency on a temporary basis. Temporarily, interested parties can grab the sorted and unique list of these IP addresses as follows, to do with as they wish (with full disclaimer and no guarantees): wget vm3.convergent-ict.com/misc/temp-spam-IPs.lis Cheers, Laurie.-- --------------------------------------------------------------------- Laurie Brown laurie@brownowl.com ---------------------------------------------------------------------