Don't know if this will help but we use the list on this site to block malicious Chinese and Korean ip addresses and network blocks via iptables - http://www.okean.com/
>>> JP Kelly <[EMAIL PROTECTED]> 2/28/2008 12:36:12 PM >>> any takers on this? On Feb 27, 2008, at 2:31 PM, Chip M. wrote: > The main thing that stands out (to me) is the China TLD in the URL. > We block all those on sight (unless they're in the recipient's > domain skip > list - so far, none of my users have any China TLDs in theirs). > > Perhaps one of the regex gurus will whip you up a rule. :)