> Thanks, Xavier.  I reckon you should block

Well, they'd use another faked domain.

But the current filter should be more efficient now.