As far as I can see the current DNSBL lists are not very effective at blocking spam as I continually get spam from the same domains or the same contries.

What would be very usesful would be an additional filter that would check the origin of the spam and allow me filter based full or partial ISP/domain adresses such as *@kornet.net or *.br

I'm assuming that the existing Filters do not look at the origin of the email, just the headers and body and therefore won't give me a solution.

You can write a filter to do this, the wiki along with past posts should get you going with the information you need.

As with my other post, I could find nothing on the wiki that explains this in any detail that I can understand or can identify as being a filter for blocking the origin of spam address.

I suppose my main problem is that I don't know where the origin of spam address appears in the spam email. If I knew that then perhaps I could write the filter. However not knowing where that appears and therefore whether the filter list actually looks in that area, then I have no hope of ever writing a filter for this.

I have emailed firetrust to ask for some help/advice and will post back here and in my other post with the information that they provide.

Look for a line like this:

Received: from mail.alk-abello.com [213.129.28.226] by mail.XXXXXX.com with ESMTP

You can either filter on the ISP name which may be forged or filter on the IP address.

Thanks for the information - will work on creating filters based on the information you have supplied.